To view FTP credentials like username and password within a packet, which Wireshark feature is used?

• A. Follow TCP Stream
• B. Follow HTTP Stream
• C. Decode As
• D. Apply display filter

Answer: (B)

When you want to see FTP credentials, you need to reconstruct the actual FTP conversation so you can read the commands as they were exchanged. FTP runs over TCP, and the USER and PASS commands travel in clear text over that connection. Using Wireshark’s Follow TCP Stream reassembles the data from that TCP session and presents the FTP dialog in a readable, in-order sequence, making the credentials visible as USER and PASS .

Follow HTTP Stream is for HTTP traffic, so it won’t reveal an FTP session. Decode As isn’t needed here because you’re simply reading the plain-text FTP commands, and an Apply display filter by itself won’t show the content of the conversation unless you also view the reassembled stream.