The following is an annotated dump of the X.224 Connection Confirm PDU (section 2.2.1.2).
00000000 03 00 00 13 0e d0 00 00 12 34 00 02 00 08 00 01 .........4......
00000010 00 00 00 ...
03 -> TPKT Header: TPKT version = 3
00 -> TPKT Header: Reserved = 0
00 -> TPKT Header: Packet length - high part
13 -> TPKT Header: Packet length - low part (total = 19 bytes)
0e -> X.224: Length indicator (14 bytes)
d0 -> X.224: Type (high nibble) = 0xd = CC TPDU; credit (low nibble) = 0
00 00 -> X.224: Destination reference = 0
12 34 -> X.224: Source reference = 0x1234 (bogus value)
00 -> X.224: Class and options = 0
02 -> RDP_NEG_RSP::type (TYPE_RDP_NEG_RSP)
00 -> RDP_NEG_RSP::flags (0)
08 00 -> RDP_NEG_RSP::length (8 bytes)
00 00 00 00 -> RDP_NEG_RSP: Selected protocols (PROTOCOL_RDP)