Protocols

What is SOCKS4?

SOCKS4 is the earlier version of the SOCKS proxy protocol. It relays TCP connections only and addresses targets by raw IPv4 address, with no authentication beyond a user ID string the proxy may ignore. The SOCKS4a extension adds hostname support. SOCKS5 superseded it, and current clients keep SOCKS4 only for legacy endpoints.

A SOCKS4 request is one compact record made of version 4, a command byte (1 for connect, 2 for bind), a two-byte destination port, a four-byte destination address and a null-terminated user ID. The proxy replies with eight bytes whose result value says what happened, where 0x5A means the request was granted and the other codes cover rejection, an unreachable identd service and a user ID mismatch. No method negotiation step exists, so a client cannot ask for password authentication and a server has no way to demand it.

IPv4 is the only address family the record can express, which rules it out on IPv6-only networks. UDP has no place in the protocol either, so DNS over UDP, QUIC and anything else datagram-based cannot pass through. SOCKS4a works around the address limit by writing an invalid address in the 0.0.0.x range and appending the hostname after the user ID; a proxy that understands the extension sees that pattern and resolves the name itself. A client speaking plain SOCKS4 must resolve locally, sending the lookup through your own resolver.

You still find the label on old scanner tools, some router firmware and public proxy lists, and checkers sometimes report a host as SOCKS4 only because nobody attempted a SOCKS5 handshake against it. Libraries keep the code path for compatibility, so PySocks, curl and most browser proxy dialogs will still let you select it. The identd mechanism the protocol leans on for identifying the calling user disappeared from normal internet practice a long time ago, which leaves the user ID field as decoration.

Treat a SOCKS4-only endpoint as an open relay unless its operator restricts access by source IP, since there is no password for it to check. IP allowlisting becomes the only workable control. For scraping or account work the missing hostname support causes the visible damage, because without SOCKS4a your DNS query leaves your own network and a site comparing resolver geography against exit IP geography sees the mismatch. Moving to SOCKS5 removes both problems and costs nothing on any endpoint that supports it.

Where you meet it

SOCKS4 turns up mostly on legacy gear and scraped proxy lists. A tool advertising SOCKS4 support is telling you it can talk to hosts that were never upgraded rather than recommending the protocol. If a client fails against a modern endpoint with an immediate rejection byte and no authentication prompt, check whether it opened a SOCKS4 request against a server that only answers SOCKS5. Setting the scheme correctly usually ends the investigation.

Common questions

What is the difference between SOCKS4 and SOCKS5?

SOCKS5 adds a negotiated authentication step including username and password, accepts IPv6 addresses and domain names, and defines a UDP relay command. SOCKS4 does TCP over IPv4 with no password check. SOCKS5 also lets the proxy perform DNS resolution, which SOCKS4 can only do through the SOCKS4a extension.

Is SOCKS4 still safe to use?

The protocol carries no encryption and no password, so an unrestricted SOCKS4 endpoint is usable by anyone who finds it. If you must use one, restrict it by source IP and put encrypted protocols over it. For anything involving accounts or paid bandwidth, a SOCKS5 or HTTP endpoint with credentials is the safer choice.

What is SOCKS4a?

An extension that lets a client pass a hostname instead of an IP address. The client writes an invalid address of the form 0.0.0.x, then appends the hostname after the user ID field, and a SOCKS4a-aware proxy resolves the name at its own end. It exists purely to avoid resolving DNS on the client side.

Related terms

SOCKS5
SOCKS5 is a session-layer proxy protocol, defined in RFC 1928, that relays TCP connections and can relay UDP datagrams for any application rather than only web traffic. It negotiates an authentication method first, then takes a target given as an IPv4 address, an IPv6 address or a domain name and forwards bytes without interpreting them.
HTTP Proxy
An HTTP proxy is a server that forwards HTTP requests on a client's behalf, parsing the protocol rather than blindly relaying bytes. The client sends the full target URL in the request line, or issues a CONNECT to tunnel an HTTPS session. Proxies conventionally listen on ports such as 8080 or 3128; port 80 belongs to the origin web server.
HTTPS Proxy
An HTTPS proxy carries encrypted TLS traffic between a client and a destination site, usually by opening a tunnel with the HTTP CONNECT method to port 443. The proxy relays raw bytes without reading the request path, headers or body. The term also describes a proxy whose own listening port accepts a TLS-encrypted client connection.
SSL/TLS
SSL and TLS are the protocols that encrypt and authenticate traffic between a client and a server. SSL is the deprecated original; TLS is what runs today, with TLS 1.2 and TLS 1.3 the only versions current software should negotiate. The handshake proves the server's identity with a certificate, then agrees the keys used for the session.
HTTP/2
HTTP/2 is a binary version of HTTP that carries many concurrent requests as multiplexed streams over a single TCP connection and compresses headers with HPACK. It keeps HTTP's methods, status codes and header semantics unchanged, so only the wire format differs. Browsers negotiate it during the TLS handshake through ALPN, advertising the identifier h2.
HTTP/3
HTTP/3 is HTTP carried over QUIC, which runs on UDP and builds the TLS 1.3 handshake into the transport itself. It keeps HTTP semantics and HTTP/2-style multiplexing while removing TCP's head-of-line blocking, so a lost packet stalls only its own stream. Clients discover it from an Alt-Svc header or an HTTPS DNS record and negotiate it as h3.
QUIC
QUIC is an encrypted transport protocol that runs over UDP instead of TCP and carries HTTP/3 traffic, normally on UDP port 443. It combines the transport and TLS 1.3 handshakes into one exchange and multiplexes independent streams without head-of-line blocking. The protocol identifies a connection by an ID rather than by an address and port pair.

Real 4G/5G mobile and residential IPs

PROXIES.SX runs carrier IPs in 100+ countries with HTTP and SOCKS5 on every endpoint. $4/GB down to $2.40/GB at volume, free endpoints and rotation, and your GB never expire.

View pricing Browse the glossary