A company's policy requires employees to perform file transfers using protocols which encrypt traffic. You suspect some employees are still performing file transfers using unencrypted protocols becaus

FTP (File Transfer Protocol) uses TCP port 21 for its control channel and transmits all data including credentials in cleartext, making it an unencrypted file transfer protocol. The Wireshark display filter tcp.port == 21 precisely targets FTP control traffic, allowing the analyst to identify employees bypassing the policy requiring encrypted file transfer protocols.

TCP port 23 is assigned to Telnet, which is an unencrypted remote terminal protocol, not a file transfer protocol - filtering on port 23 would not reveal FTP activity.

Adding tcp.port == 22 alongside port 21 would also capture SSH and SFTP traffic, which are encrypted file transfer methods compliant with policy, contaminating the results with authorized transfers.

Filtering tcp.port != 21 excludes FTP traffic entirely and captures all other TCP ports, which would not specifically identify unencrypted file transfer activity and would flood results with unrelated traffic.