# \- extract file from SMB2

**URL:** <https://community.zeek.org/t/extract-file-from-smb2/6357>\
**Category:** Zeek\
**Created:** [June 13, 2021, 8:36am UTC](https://community.zeek.org/t/extract-file-from-smb2/6357 "2021-06-13T08:36:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![antwerp\_log](https://avatars.discourse-cdn.com/v4/letter/a/f9ae1b/32.png) [@antwerp\_log](https://community.zeek.org/u/antwerp_log)\
**Post date:** [June 13, 2021, 8:36am UTC](https://community.zeek.org/t/extract-file-from-smb2/6357/1 "2021-06-13T08:36:57Z")

</div>

Hi everyone

I have a pcap recording of a SMB2 file transfer to a network share.  
In wireshark I can extract the transferred file, whilst in Zeek the file is not extracted.

I am using zeek 3.0 with extract-all-files.zeek script loaded.  
Loading dump-events shows that no new\_file event is raised.

Any idea what can be the cause of this?

Command line format :  
zeek -Cr /tmp/file.pcap local -e “@load /usr/local/share/zeek/policy/misc/dump-events.zeek” -e “@load /usr/local/share/zeek/policy/frameworks/files/extract-all-files.zeek”

Thank you !  
Ant

---

<div class="post-metadata">

**Author:** ![Vlad\_Grigorescu](https://avatars.discourse-cdn.com/v4/letter/v/a3d4f5/32.png) [@Vlad\_Grigorescu](https://community.zeek.org/u/Vlad_Grigorescu)\
**Post date:** [June 14, 2021, 1:09pm UTC](https://community.zeek.org/t/extract-file-from-smb2/6357/2 "2021-06-14T13:09:56Z")

</div>

Can you share the PCAP?

BTW, it’s a bit easier to run Zeek as follows:

zeek -Cr /tmp/file.pcap local misc/dump-events frameworks/files/extract-all-files

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/extract-file-from-smb2/6357/3 "2022-05-06T15:47:41Z")

</div>

Closed on May 6, 2022, 3:47pm UTC