First find the connections and the Passwords:
tshark -nn -r ftp2.dmp '(tcp.port == 21) and (ftp.request.command == "PASS" or ftp.request.command == "USER") ' -T fields -E separator=" " \
-e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport -e ftp.request.command -e ftp.request.arg -e ftp.response.code -e ftp.response.arg
This will generate the following List with the connections With the User/Passwords
192.168.2.100 43351 130.59.10.36 21 USER anonymous
192.168.2.100 43351 130.59.10.36 21 PASS NcFTP@
192.168.2.100 46339 62.2.XXX.XXX 21 USER anonymous
192.168.2.100 46339 62.2.XXX.XXX 21 PASS @
192.168.2.100 46340 62.2.XXX.XXX 21 USER anonymous
192.168.2.100 46340 62.2.XXX.XXX 21 PASS usr@world.ch
192.168.2.100 37950 195.186.3.165 21 USER anonymous
192.168.2.100 37950 195.186.3.165 21 PASS @