Eliana, a network administrator, is tasked with monitoring FTP traffic on her organization's network. She suspects that there might be ongoing password cracking attempts targeting the FTP server. To…

Question

Options

• Aftp.response.code == 532
• Bftp.response.code == 230
• Cftp.response.code == 530
• Dftp.response.code == 521

• A
  9% (2)
• B
  14% (3)
• C
  73% (16)
• D
  5% (1)

Explanation

According to the CHFI v11 Network Forensics and Log Analysis objectives, monitoring authentication failures is a critical technique for detecting brute-force and password cracking attacks against network services such as FTP. FTP servers communicate authentication outcomes using standardized FTP response codes, which can be filtered and analyzed using tools like Wireshark. The FTP response code 530 explicitly indicates "Not logged in", which commonly occurs when a user provides invalid credentials (incorrect username or password). During brute-force or password spraying attacks, repeated failed login attempts generate multiple 530 response codes, making this filter highly effective for identifying malicious authentication activity. In contrast, ftp.response.code == 230 indicates a successful login, which is not relevant when tracking failed attempts. The 532 response code means that an account is required for login, not necessarily a password failure. The 521 response code indicates that the FTP service is unavailable, which reflects server-side issues rather than authentication failures. CHFI v11 specifically emphasizes correlating network traffic patterns and protocol response codes to identify unauthorized access attempts and credential-based attacks. Filtering for ftp.response.code == 530 allows investigators to isolate failed authentication attempts accurately and build evidence of potential password cracking activity.

No community discussion yet for this question.