not extracting file transmitted via smb2

Zeek
1

Hi everyone

I have a pcap file of a SMB2 file transfer.
tshark can extract the transferred file without any issue.
when running zeek with extract-all-files I do not see the file being extracted.
Moreover, running dump-events on the pcap file, I see no file_new, file_sniff events, only get_file_handle events

any suggestions ?
thanks

2

If you could share the PCAP, I’d be happy to take a look. SMB is our most complex analyzer, it’s not even close, so it’s possible there’s a command/option that’s not being parsed correctly.