In Wireshark, what does the filter 'tcp.port != 21' accomplish?

• A. It filters out traffic that is not using FTP (port 21).
• B. It filters only traffic on port 21.
• C. It filters out all TCP traffic.
• D. It filters traffic based on packet size.

Answer: (A)

The filter is querying TCP traffic by port and uses a “not equal” condition. In Wireshark, tcp.port refers to either the source or destination port of a TCP segment, and the operator != means “not equal to.” So tcp.port != 21 includes only those TCP packets where neither end of the connection uses port 21. Since port 21 is the well-known FTP control port, this filter effectively hides FTP control traffic and shows all other TCP traffic. It does not restrict to traffic on port 21 (that would be tcp.port == 21), and it does not exclude all TCP traffic or filter by packet size.