Article Number
000032411
Applies To
RSA Product Set: Security Analytics
RSA Product/Service Type: Security Analytics UI, Packet Decoder, Packet Hybrid, Packet AIO
RSA Version/Condition: 10.3.x, 10.4.x, 10.5.x
Platform: CentOS
O/S Version: EL6
Issue
When files are extracted from SMB2 sessions in Security Analytics Investigation, some files are found to be incomplete.
Cause
The problem is due to the decoder service not processing the previous response data when the current buffer contains new requests.
Resolution
The issue is currently under investigation by RSA and the fix is targeted to be included in 10.6.0.2 which is tentatively scheduled to be released by Q1 2016.
