Eliana, a network administrator, is tasked with monitoring FTP traffic on her organization’s network. She suspects that there might be ongoing…

The File Transfer Protocol (FTP) uses a standard set of three-digit response codes to communicate status between the client and server. According to RFC 959, the response code 530 specifically means "Not logged in." This code is returned by an FTP server when a login attempt fails due to an incorrect username or password, or when a user attempts a command that requires authentication without first logging in. Therefore, applying the Wireshark display filter ftp.response.code == 530 will isolate and display all packets containing this specific server response, allowing an administrator to effectively track failed login attempts.

A. The FTP code 532 ("Need account for storing files") is related to file storage permissions after a user is already authenticated.
B. The FTP code 230 ("User logged in, proceed") indicates a successful login, which is the opposite of what needs to be monitored.
D. The FTP code 521 is not a standard response code for login failure as defined in the primary FTP specifications like RFC 959.

1. Postel, J., & Reynolds, J. (1985). File Transfer Protocol (FTP) (RFC 959). Internet Engineering Task Force. Section 4.2, "FTP Replies," defines the reply codes. Page 39 lists 530 as "Not logged in."

2. Wireshark Foundation. Wireshark Display Filter Reference: File Transfer Protocol (FTP). The official Wireshark documentation lists ftp.response.code as the display filter field for FTP response codes, which can be used to filter for specific numerical codes like 530.

3. Comer, D. E. (2018). Internetworking with TCP/IP Vol. 1: Principles, Protocols, and Architecture (6th ed.). Pearson. Chapter 27, "File Transfer and Access (FTP and TFTP)," discusses the FTP command and reply sequence, referencing the standard codes for login success and failure.