How can RDP connections on the network be identified if they are no longer using TCP 3389 and instead using a non-standard port?

If the administrator of a system changed the port for remote connections from 3389 to something else and not updated same in IDS or firewall, then how can someone detect the active remote connections at the network level?

  • 1
    Please specify which kind of system you use and how your network is configured. This information is necessary to help you setting up network sensors or configuring existing systems. – rbialon May 27 '15 at 10:33
  • i am seaking information for in general network not specific to certain configuration. – Swapnil Patil May 27 '15 at 10:50
  • Okay, without further details I assume that Deep Packet Inspection would be the way to go. But it's got a very high resource usage and has to be implemented at a gateway before the remotely accessed system. Once again, I do not know your configuration, but iptables has the ability to do DPI and react upon RDP packets. You'll have to find out the significant parts of RDP packets to scan for them, though. – rbialon May 27 '15 at 11:50
  • Do you have access to the system or is your question strictly from a network monitoring perspective? If the latter, what monitoring is currently in place or available? – user2320464 May 27 '15 at 14:33
  • @user2320464 my question is fully based on Network monitoring perspective – Swapnil Patil May 27 '15 at 14:41

The only way you can identify "rogue" remote connections that are inside your network (and because your use case eliminates using the port number as identifier ) is through deep packet inspection on the network.

If you want to know outgoing connection from a specific machine and you have access to the root user of said machine. You can ask the network stack what connections it has ('''ss''' on Ubuntu but all systems have some way) This will list all connections the system has. (Including sockets)


The following Wireshark link provides a great overview of what to look for and can be used to create a rule for your environment.


If you're running snort (or similar IPS/IDS), there are signatures for remote desktop connections. So they could be modified to monitors other ports and a quick search shows rules specifically for identifying the scenario you're looking to address.

RDP connections often use self-signed certificates or those issued by the internal Active Directory PKI. This is useful if you have capabilities to monitor/alert on certs traversing the network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.