Which component can you use to find an attack for traffic that uses a nonstandard service?

Which component can you use to find an attack for traffic that uses a nonstandard service?

A.
last packet

B.
ToS markings

C.
first packet

D.
last data packet