issues with file extraction. Multiple files created.

Zeek
1

Hello,
I have been experienced strange behavior of BRO file extraction .

Here you can see what is extracted in bro extract directory.

0 Dec 20 07:42 HTTP-FZyPZr1vrwJ5czHazj.swf
0 Dec 20 07:42 HTTP-FZyPZr1vrwJ5czHazj.swf.1
0 Dec 20 07:42 HTTP-FZyPZr1vrwJ5czHazj.swf.1.1
0 Dec 13 06:42 HTTP-FZyPZr1vrwJ5czHazj.swf.1.1.1
0 Dec 6 06:57 HTTP-FZyPZr1vrwJ5czHazj.swf.1.2
0 Dec 20 07:42 HTTP-FZyPZr1vrwJ5czHazj.swf.2
0 Dec 13 06:42 HTTP-FZyPZr1vrwJ5czHazj.swf.2.1
359 Dec 1 09:36 HTTP-FZyPZr1vrwJ5czHazj.swf.3

Where should I check for troubleshoot ?

I just expected to have one file extracted 359 Dec 1 09:36 HTTP-FZyPZr1vrwJ5czHazj.swf instead of those multiples with zero bytes.

2

Do you have a packet capture that you can share that causes this?