Use SESSIONNAME instead of CLIENTNAME to try to detect RDP sessions.

Look for a string that starts with "rdp".  This should take care of
cases where a default capture filter is set needlessly.

Update the docs accordingly.

svn path=/trunk/; revision=19236

1 files changed, 16 insertions, 4 deletions

diff --git a/util.c b/util.c
index ed79b9aea7..36a579305e 100644
--- a/util.c
+++ b/util.c
@@ -134,7 +134,7 @@ compute_timestamp_diff(gint *diffsec, gint *diffusec,
    SSH_CLIENT (ssh): <remote IP> <remote port> <local port>
    REMOTEHOST (tcsh, others?): <remote name>
    DISPLAY (x11): [remote name]:<display num>
-   CLIENTNAME (terminal server): <remote name>
+   SESSIONNAME (terminal server): <remote name>
  */
 
 const gchar *get_conn_cfilter(void) {
@@ -174,9 +174,21 @@ const gchar *get_conn_cfilter(void) {
 				host_ip_af(tokens[0]), tokens[0]);
 			return filter_str->str;
 		}
-	} else if ((env = getenv("CLIENTNAME")) != NULL) {
-		g_string_sprintf(filter_str, "not tcp port 3389");
-		return filter_str->str;
+	} else if ((env = getenv("SESSIONNAME")) != NULL) {
+        /* Apparently the KB article at
+         * http://technet2.microsoft.com/WindowsServer/en/library/6caf87bf-3d70-4801-9485-87e9ec3df0171033.mspx?mfr=true
+         * is incorrect.  There are _plenty_ of cases where CLIENTNAME
+         * and SESSIONNAME are set outside of a Terminal Terver session.
+         * It looks like Terminal Server sets SESSIONNAME to RDP-TCP#<number>
+         * for "real" sessions.
+         *
+         * XXX - There's a better way to do this described at
+         * http://www.microsoft.com/technet/archive/termsrv/maintain/featusability/tsrvapi.mspx?mfr=true
+         */
+		if (g_strncasecmp(env, "rdp", 3) == 0) {
+			g_string_sprintf(filter_str, "not tcp port 3389");
+			return filter_str->str;
+		}
 	}
 	return "";
 }