A connection is potentially being tunnelled if the port is not 22, and the ip refers to the localhost.

Source Code

# File net/ssh/lenient-host-key-verifier.rb, line 16
def tunnelled?(args)
  return false if args[:peer][:port].to_i == 22

  ip = args[:peer][:ip]
  return ip == "127.0.0.1" || ip == "::1"
end