ECCouncil Exam Questions

what service is being exploited?

Exhibit:
Given the following extract from the snort log on a honeypot, what service is being exploited? :

A.
FTP

B.
SSH

C.
Telnet

D.
SMTP

Explanation:
The connection is done to 172.16.1.104:21.