[Bro] issues with file extraction. Multiple files created.

[Giedrius Ramas]

Hello,
I have been experienced strange behavior of BRO file extraction .

Here you can see what is extracted in bro extract directory.


0 Dec 20 07:42 HTTP-FZyPZr1vrwJ5czHazj.swf
0 Dec 20 07:42 HTTP-FZyPZr1vrwJ5czHazj.swf.1
0 Dec 20 07:42 HTTP-FZyPZr1vrwJ5czHazj.swf.1.1
0 Dec 13 06:42 HTTP-FZyPZr1vrwJ5czHazj.swf.1.1.1
0 Dec  6 06:57 HTTP-FZyPZr1vrwJ5czHazj.swf.1.2
0 Dec 20 07:42 HTTP-FZyPZr1vrwJ5czHazj.swf.2
0 Dec 13 06:42 HTTP-FZyPZr1vrwJ5czHazj.swf.2.1
359 Dec  1 09:36 HTTP-FZyPZr1vrwJ5czHazj.swf.3



Where should I check for troubleshoot ?

I just expected to have one file extracted 359 Dec  1 09:36
HTTP-FZyPZr1vrwJ5czHazj.swf instead of those multiples with zero bytes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20151221/1356134d/attachment.html