# HELP? bro-pkg hosom/file-extraction to write files when reading pcaps **URL:** \ **Category:** Zeek\ **Created:** [November 10, 2017, 1:02am UTC](https://community.zeek.org/t/help-bro-pkg-hosom-file-extraction-to-write-files-when-reading-pcaps/5094 "2017-11-10T01:02:30Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Ludwig\_Goon](https://avatars.discourse-cdn.com/v4/letter/l/46a35a/32.png) [@Ludwig\_Goon](https://community.zeek.org/u/Ludwig_Goon)\ **Post date:** [November 10, 2017, 1:02am UTC](https://community.zeek.org/t/help-bro-pkg-hosom-file-extraction-to-write-files-when-reading-pcaps/5094/1 "2017-11-10T01:02:30Z")
Wanted to post this to the bro community. I am trying to use the hosom/file-extraction plugin however I can’t get it to create a directory like ./extracted-files to put them in when I am reading a pcap file. Does anyone in the bro community have any insight on how to do this? I am using bro 2.5.1 and the current github version of bro. ---
**Author:** ![Hosom\_Stephen\_M](https://avatars.discourse-cdn.com/v4/letter/h/d26b3c/32.png) [@Hosom\_Stephen\_M](https://community.zeek.org/u/Hosom_Stephen_M)\ **Post date:** [November 10, 2017, 6:24pm UTC](https://community.zeek.org/t/help-bro-pkg-hosom-file-extraction-to-write-files-when-reading-pcaps/5094/2 "2017-11-10T18:24:44Z")
When you run Bro against a pcap, the easiest thing to do is use the default plugin(s) for file extraction... The command I use for ad-hoc extraction from pcaps that I am working is: bro -r foo.pcap ./file-extraction/plugins/extract-all-files.bro Be careful when using that to read packet captures that are large. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/help-bro-pkg-hosom-file-extraction-to-write-files-when-reading-pcaps/5094/3 "2022-05-06T15:45:24Z")