I know that Citrix protocol analyzer is supported and even special agent exists to catch user ID on Citrix server side.
Is similar technology supported for Microsoft Terminal services? To catch user ID and track user session.
Kind thanks for all suggestions.
It doesn't work the same way. In fact, only the TCAM piece would work. There is no decode available for RDP. You may use generic TCP (and UDP) decodes for RDP, but these won't provide ore information beyond volumetric and general network quality (RTT, ACK RTT, retransmission rate).
However, some customers use it as an auxiliary data source for the whole application delivery chain monitoring - if expectations are set right, it works.
This is correct. There is no RDP analyzer because such analyzer will not provide much value. RDP is internally encrypted with RC4 (which is based on Diffie-Hellmann algorithm), so decryption off-path is not feasible. Analysis of the encrypted stream functionally equals generic TCP analysis, which the Generic TCP decode does.