Example situation: a user connected to a server through RDP, port
3389, and works in the server for 4 hours. She does not disconnect and from her point of view, the connection is uninterrupted for the whole duration of 4 hours.
Will this connection be represented by 1 firewall event
source port, user's IP, destination port , destination IP [the server] in the firewall logs? Or is the connection being periodically renewed but it is transparent to the user, hence several connection events would be observed in the FW logs?
Is this decided by the way RDP protocol works or does it depend on implementation and thus both outcomes can be true depending on the implementation?