3.1.5.4 Processing Tunnel Data PDUs
Tunnel Data PDUs (section 2.2.2.3) are transmitted with the Action field of the embedded RDP_TUNNEL_HEADER structure (section 2.2.1.1) set to RDPTUNNEL_ACTION_DATA (0x3).
The offset, in bytes, to the start of the data payload is stored in the HeaderLength field of the embedded RDP_TUNNEL_HEADER structure, as described in section 3.1.5.3. The total length, in bytes, of the data payload is stored in the PayloadLength field as described in section 3.1.5.2.