I have a pcap file of a SMB2 file transfer.
tshark can extract the transferred file without any issue.
when running zeek with extract-all-files I do not see the file being extracted.
Moreover, running dump-events on the pcap file, I see no file_new, file_sniff events, only get_file_handle events
any suggestions ?