Which of the following best describes a sign of tunneling when SSH appears inside ICMP?

• A. It indicates unusual traffic patterns.
• B. It indicates blocked traffic.
• C. It indicates tunneling activity.
• D. It indicates ARP spoofing.

Answer: (C)

When SSH appears inside ICMP, it signals a covert channel being used—SSH data is being tunneled through ICMP messages. SSH normally runs over TCP, so seeing its payload encapsulated in ICMP packets is not standard traffic; it indicates tunneling activity, often used to bypass filters or monitoring. It’s not simply unusual traffic patterns, nor does it imply blocked traffic or ARP spoofing, which involve different mechanisms.