Security — RDP DVC Watcher

Last updated: July 12, 2026 · All security pages · Privacy · Source

Summary: A local ETW diagnostics tool. It requires administrator rights, reads only channel names and byte counts, and stores/sends nothing.

Attack surface

• No network surface — no listeners, no outbound calls, no telemetry.

Privileges & data

• Requires Administrator to open the ETW trace session.
• It reads only per-channel names and traffic byte counts — no message content and no personal data. Counts are held in memory and printed to the console; nothing is persisted.

Running it safely

• Run elevated only while you need to observe RDP channel traffic, then close it.

Reporting

Found an issue? See how to report a vulnerability or email gus@guscatalano.com.