- extract file from SMB2

Zeek
1

Hi everyone

I have a pcap recording of a SMB2 file transfer to a network share.
In wireshark I can extract the transferred file, whilst in Zeek the file is not extracted.

I am using zeek 3.0 with extract-all-files.zeek script loaded.
Loading dump-events shows that no new_file event is raised.

Any idea what can be the cause of this?

Command line format :
zeek -Cr /tmp/file.pcap local -e “@load /usr/local/share/zeek/policy/misc/dump-events.zeek” -e “@load /usr/local/share/zeek/policy/frameworks/files/extract-all-files.zeek”

Thank you !
Ant

2

Can you share the PCAP?

BTW, it’s a bit easier to run Zeek as follows:

zeek -Cr /tmp/file.pcap local misc/dump-events frameworks/files/extract-all-files