# What is protocol tunnelling?

Protocol tunnelling is hiding one kind of traffic inside another so that it passes firewalls and looks harmless: commands or stolen data wrapped in DNS lookups, in ordinary web requests, in ICMP pings or inside an SSH connection. Attackers use it to keep a command channel open when direct connections are blocked, or to reach internal systems through a single compromised host. It shows up as protocols behaving oddly: DNS queries with long random names, pings carrying far more data than usual, an SSH session that lasts for days and moves a lot of data, or a host forwarding connections for others. Limit which protocols may leave the network and from which hosts, and force DNS through your own resolvers. NetSenX detects DNS tunnelling and flags beaconing and unusual outbound volume on every plan; it never decrypts traffic, so an encrypted tunnel is judged by its pattern.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/what-is-protocol-tunnelling

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [Why do attackers use legitimate remote-access tools?](https://netsenx.com/en/faq/why-do-attackers-use-legitimate-remote-access-tools)
- [What is wiper malware?](https://netsenx.com/en/faq/what-is-wiper-malware)
- [What is cryptojacking, and can we see it on the network?](https://netsenx.com/en/faq/what-is-cryptojacking)
- [What is lateral movement in cybersecurity?](https://netsenx.com/en/faq/what-is-lateral-movement-in-cybersecurity)
- [How do you detect C2 beaconing?](https://netsenx.com/en/faq/how-do-you-detect-c2-beaconing)