Well, a 'tunnel' is really just defined as traffic sent between 2 endpoints encapsulated in another protocol. Therefore, by definition, the AP only has a *single* 'tunnel' to the controller.

Obviously the LWAPP protocol has header information that clearly communicates the SSID and frame type (user, maint, keepalive, admin, config, etc.) between the controller and the AP.

Ethereal has a pretty good packet decode for LWAPP traffic and may be a good start if you want to dissect the protocol further...