Please help me, 50 points for this one also don't be a greedy person and respond something like "idk" for the points, thats simply s-t-u-p-i-d

Explain why it is reasonable to assume that receiving 3 duplicate acks in tcp is an indication that the network is not currently congested.

You are working as a security analyst in a company xyz that owns the whole subnet range of 23.0.0.0/8 and 192.168.0.0/8. while monitoring the data, you find a high number of outbound connections. you see that ip's owned by xyz (internal) and private ip's are communicating to a single public ip. therefore, the internal ip's are sending data to the public ip. after further analysis, you find out that this public ip is a blacklisted ip, and the internal communicating devices are compromised. what kind of attack does the above scenario depict?

What is the term for water wave that is created by an underwater earthquake