A company's policy requires employees to perform file transfers using protocols which encrypt traffic. You suspect some employees are still performing file transfers using unencrypted protocols becaus

The display filter `tcp.port == 21` in Wireshark will specifically show traffic destined for or originating from TCP port 21. This port is the well-known control port for FTP (File Transfer Protocol), which is an unencrypted protocol used for file transfers, thus matching the requirement to find unencrypted file transfers.

The display filter `tcp.port == 23` targets TCP port 23, which is used by Telnet. While Telnet is unencrypted, it is primarily a remote access protocol, not a dedicated file transfer protocol like FTP.

The display filter `tcp.port == 21 || tcp.port == 22` includes both FTP (port 21, unencrypted) and SSH/SFTP (port 22, encrypted). The question specifically asks to find *unencrypted* file transfers, so including port 22 is incorrect.

The display filter `tcp.port != 21` would show all TCP traffic that is *not* on port 21. This would include many other protocols, both encrypted and unencrypted, and would not specifically isolate unencrypted file transfer traffic.