According to the CHFI v11 Network Forensics and Log Analysis objectives , monitoring authentication failures is a critical technique for detecting brute-force and password cracking attacks against network services such as FTP. FTP servers communicate authentication outcomes using standardized FTP response codes , which can be filtered and analyzed using tools like Wireshark .
The FTP response code 530 explicitly indicates "Not logged in" , which commonly occurs when a user provides invalid credentials (incorrect username or password). During brute-force or password spraying attacks, repeated failed login attempts generate multiple 530 response codes , making this filter highly effective for identifying malicious authentication activity.
In contrast, ftp.response.code == 230 indicates a successful login , which is not relevant when tracking failed attempts. The 532 response code means that an account is required for login, not necessarily a password failure. The 521 response code indicates that the FTP service is unavailable, which reflects server-side issues rather than authentication failures.
CHFI v11 specifically emphasizes correlating network traffic patterns and protocol response codes to identify unauthorized access attempts and credential-based attacks. Filtering for ftp.response.code == 530 allows investigators to isolate failed authentication attempts accurately and build evidence of potential password cracking activity.
Therefore, the correct and CHFI-verified answer is ftp.response.code == 530 (Option C) .