[Bro] issues with file extraction. Multiple files created.

Hosom, Stephen M hosom at battelle.org
Mon Dec 21 05:06:28 PST 2015


Do you have a packet capture that you can share that causes this?

From: bro-bounces at bro.org [mailto:bro-bounces at bro.org] On Behalf Of Giedrius Ramas
Sent: Monday, December 21, 2015 2:28 AM
To: bro at bro.org
Subject: [Bro] issues with file extraction. Multiple files created.

Hello,
I have been experienced strange behavior of BRO file extraction .

Here you can see what is extracted in bro extract directory.


0 Dec 20 07:42 HTTP-FZyPZr1vrwJ5czHazj.swf
0 Dec 20 07:42 HTTP-FZyPZr1vrwJ5czHazj.swf.1
0 Dec 20 07:42 HTTP-FZyPZr1vrwJ5czHazj.swf.1.1
0 Dec 13 06:42 HTTP-FZyPZr1vrwJ5czHazj.swf.1.1.1
0 Dec  6 06:57 HTTP-FZyPZr1vrwJ5czHazj.swf.1.2
0 Dec 20 07:42 HTTP-FZyPZr1vrwJ5czHazj.swf.2
0 Dec 13 06:42 HTTP-FZyPZr1vrwJ5czHazj.swf.2.1
359 Dec  1 09:36 HTTP-FZyPZr1vrwJ5czHazj.swf.3



Where should I check for troubleshoot ?

I just expected to have one file extracted 359 Dec  1 09:36 HTTP-FZyPZr1vrwJ5czHazj.swf instead of those multiples with zero bytes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20151221/0a786f6e/attachment.html 


More information about the Bro mailing list