You'll have to look for TPKT packets in the capture, and use 'Decode As...'. They could be on TCP port 3389.
