Hello man,
Sorry to busy working for the CCIE this upcoming week.
So I tough I have replied to you, Basically on the capture I see the traffic reaching the server and the server replying with a RESET basically saying get the f&*^ out of here: I do not allow RDP.
So that being investigation will need to be done on your RDP server
Please rate all of the helpful posts
Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC