TCPStatFlow is a tool for network administrators which detects covert network tunnels running on ports which are accepted by most outbound firewalls by sniffing the network and measuring the symmetry of the data sent. HTTP / HTTPS / FTP / SMTP / POP3 protocols send much more data one direction than the other, and if a ssh server is set up on these ports, this tool will detect it by noticing that the amounts of data sent don’t look like the protocol which is supposed to run on that port.
You can download it from the following link: https://packetstormsecurity.com/files/download/32230/tcpstatflow_v1.1.tgz
Source: https://packetstormsecurity.com/files/32230/tcpstatflow_v1.1.tgz.html