Load balancing failing - how to sniff traffic for testing

Hi!

My company forces me to log into windows remotely via RDP, so let me
first say that I am very happy that rdesktop exists, thank you!

Unfortunately the latest load-balancer they put in place crashes
rdesktop (1.6.0 and trunk).

The synopsis is as follows:
Connection between ubuntu 10.04 running rdesktop trunk / 1.6.0 and an
unknown RDP server (login screen shows windows server 2003).
A successful connection is made initially, showing the login screen.
Typing in the login screen works fine.
After pressing OK in the login screen, the X windows is closed and the
following output is shown on stdout:

WARNING: server sent an unexpectedly long string, truncating
WARNING: PDU_REDIRECT_DONT_STORE_USERNAME set
g_num_channels is 1
Requesting channel cliprdr
ERROR: : unable to resolve host

The resolve host error is accompanied by a couple of DNS requests for
the hosts NULL and <random data>, so I assumed that it was a parsing
error of a redirect request from the server. This seems to be
confirmed by the fact that the login sometimes succeeds (in which case
no redirect is probably made). I've found and tried the patches
supplied by Daniel Brown in January
(http://sourceforge.net/mailarchive/forum.php?thread_name=20100120194912.GB29970%40vps.drown.org&forum_name=rdesktop-devel)
(patched to revision 1555) with no luck.

So now I would like to debug this problem and try to contribute a patch.

I thought that I could just sniff the traffic and figure out how to
parse the data - until I realized that RDP has built-in encryption and
my pcaps were useless.

So I read parts of the thesis 'Reverse-Engineering and Implementation
of the RDP 5 Protocol' where they use a two-way proxy called rdpproxy
to dump the data. This would be great, but I can't seem to find the
source code (not in trunk anyway), so no luck there.

Second try was to start rdesktop with '-e', but this just results in a
'ERROR: Connection closed' quite quickly on this particular connection
(don't know why). I also couldn't find any dump / sniff / verbosity
flag for the program.

Finally I just figured that the people on the dev list would know how
to sniff the traffic, so I'm asking you.

Best Regards,

Alexander

------------------------------------------------------------------------------
Sell apps to millions through the Intel(R) Atom(Tm) Developer Program
Be part of this innovative community and reach millions of netbook users 
worldwide. Take advantage of special opportunities to increase revenue and 
speed time-to-market. Join now, and jumpstart your future.
http://p.sf.net/sfu/intel-atom-d2d