TCP port 21 is used by the File Transfer Protocol (FTP), which is an unencrypted protocol. To detect if unencrypted file transfers are taking place, you can apply the Wireshark display filter:
tcp.port == 21
This will show all traffic to and from FTP servers. Since FTP transmits usernames, passwords, and data in clear text, its use would violate the company's policy.
CEH v13 states:
"FTP (Port 21) is a cleartext protocol vulnerable to sniffing. To enforce secure communication, companies often transition to SFTP (over SSH, port 22) or FTPS (FTP over TLS/SSL)." Incorrect Options:
B). Port 23 is used for Telnet, not FTP.
C). Combining FTP (21) and SSH/SFTP (22) would include encrypted traffic, which is not what you're trying to isolate.
D). tcp.port != 21 filters out FTP traffic, which is the opposite of the intended goal.
Reference - CEH v13 Guide:
Module 01: Introduction to Ethical Hacking
Subsection: Sniffing and Cleartext Protocols
Wireshark iLab: Identifying FTP Traffic
=

This scenario matches a Teardrop attack, which exploits IP fragmentation reassembly weaknesses by sending fragments with overlapping or inconsistent offset fields. In a teardrop attack, the attacker crafts IP fragments so that when the target attempts to reassemble them into the original datagram, the fragment offsets and sizes do not align correctly (often overlapping). Vulnerable systems can experience errors in the reassembly process, leading to CPU/memory exhaustion, crashes, or instability in the network stack. The question highlights "manipulated offset fields and overlapping payload offsets," "repeated attempts to reconstruct," and
"deliberately malformed offsets that trigger processing errors rather than a simple flood," which are all core teardrop characteristics.
The impact described-system crashes and service disruption without abnormal bandwidth usage-also fits.
This is not a volumetric DoS (like ICMP flood); it's a malformed-packet attack that targets protocol stack processing. The key is that the attacker is exploiting how the target handles fragmented packets, causing excessive processing and failure during reassembly.
Why the other options are less accurate:
Fragmentation attack (A) is a broader category and could include many fragmentation-based manipulations, but "overlapping offsets causing reassembly failure" is the classic teardrop pattern.
ICMP flood (B) is bandwidth/packet-rate driven and does not involve IP fragment offset manipulation.
Ping of Death (D) involves oversized ICMP packets (often via fragmentation) exceeding maximum IP size, causing crashes on vulnerable stacks; the scenario instead emphasizes overlapping offsets and reassembly logic errors rather than oversized packet size.
Therefore, Sofia is most likely simulating C. Teardrop Attack.

The component described is responsible for handling incoming HTTP requests and coordinating with modules for functions like encryption, URL rewriting, and authentication. This aligns with the core HTTP server, which processes requests and delegates tasks to supporting modules.