An attacker is tunneling TLS encrypted traffic within ICMP echo and reply packets. How will most network appliances see this?

Reverse shell traffic is characterized by outbound TCP connections carrying interactive command sessions, not ICMP packets, so appliances would not classify ICMP as a reverse shell.

Covert TCP traffic specifically abuses TCP header fields (such as ISN or urgent pointer) to hide data - it is TCP-based and unrelated to ICMP tunneling.

ICMP tunneling works by embedding arbitrary payloads - in this case TLS data - inside the data field of ICMP echo request and reply packets. Standard firewalls, routers, and IDS devices make forwarding and classification decisions based on the outer IP/ICMP headers, so they see only legitimate ping traffic. Without deep payload inspection, the encapsulated TLS content is invisible to the appliance.

Network appliances see the outermost protocol, which is ICMP - not TLS - unless they perform deep packet inspection that decodes the ICMP payload.