Suricata

Suricata 8.0.7 (the same code in master at 4badfd1, rust/src/rdp/rdp.rs parse_ts): the RDP parser creates an X224ConnectionRequest transaction (and logs the cookie) for any Connection Request in the to-server stream, also when other TPKT PDUs came first. RDP servers require the Connection Request to be the first PDU: xrdp 0.9.24 and FreeRDP 3.32.1 do not answer one that follows a TPKT DT PDU. So Suricata reports an RDP connection attempt that the server never processed.

Reproduction: one TCP connection to port 3389 carrying 03 00 00 09 02 f0 80 58 58 (a TPKT/X.224 DT PDU) followed by a valid Connection Request with Cookie: mstshash=E9COOKIE. Result: eve rdp event with the cookie; xrdp and FreeRDP do not answer. (I can share the pcap.)

Severity is low (a logging/insertion discrepancy, not a crash). A possible fix is to accept the Connection Request only as the first to-server PDU, and raise an app-layer event otherwise. I can prepare a PR with a suricata-verify test if this is wanted.

I used Claude Code (Claude Opus 5.5) to help find this and write the report, and checked it myself.