SOCKS4 vs SOCKS5

SOCKS5 is the more advanced and widely recommended proxy protocol compared to SOCKS4, primarily offering support for UDP traffic, IPv6, and various authentication methods, whereas SOCKS4 is limited to TCP connections, IPv4, and lacks authentication.

A SOCKS (Socket Secure) proxy operates at Layer 5 (the session layer) of the OSI model, acting as an intermediary between a client application and a server. Unlike application-specific proxies (e.g., HTTP proxies), SOCKS proxies are protocol-agnostic, forwarding all traffic on behalf of the client without interpreting the network protocol itself. This allows them to handle various traffic types, including HTTP, HTTPS, FTP, and more, by establishing a connection to the target server and relaying data.

SOCKS4 Protocol

SOCKS4 is an older version of the SOCKS protocol, designed for simpler proxying requirements.

Core Functionality

SOCKS4 exclusively supports the proxying of TCP (Transmission Control Protocol) connections. When a client wants to establish a connection to a target server via a SOCKS4 proxy, it sends a connection request to the proxy server. The proxy then establishes the connection to the target on behalf of the client and relays data between them.

Limitations

• TCP Only: SOCKS4 cannot handle UDP (User Datagram Protocol) traffic, making it unsuitable for applications that rely on UDP for communication, such as online gaming, video streaming, or certain VoIP services.
• IPv4 Only: It is designed to work solely with IPv4 addresses. It does not support IPv6, which limits its utility in modern network environments increasingly adopting IPv6.
• No Authentication: SOCKS4 does not provide any built-in authentication mechanisms. Any client can connect and use the proxy, making it less secure for public or shared proxy services. The USERID field in the SOCKS4 request is merely an identifier and not for authentication.
• Client-Side DNS Resolution: The client application must resolve the target hostname to an IPv4 address before sending the request to the SOCKS4 proxy. The proxy receives an IP address, not a domain name.
• Limited Commands: SOCKS4 primarily supports a single command for establishing a connection.

SOCKS4a Extension

An unofficial extension, SOCKS4a, was introduced to address the client-side DNS resolution limitation. With SOCKS4a, clients can send a domain name instead of an IP address. The proxy server then performs the DNS resolution. Despite this improvement, SOCKS4a still retains the other limitations of SOCKS4, such as TCP-only and IPv4-only support.

SOCKS4 Request Structure (Conceptual)

A SOCKS4 connection request typically involves the client sending a byte sequence to the proxy.

+----+----+----+----+----+----+----+----+----+----+....+----+
| VN | CD | DSTPORT |      DSTIP        | USERID       | NULL |
+----+----+----+----+----+----+----+----+----+----+....+----+
  1    1      2              4           variable      1

• VN: Version Number (0x04 for SOCKS4)
• CD: Command Code (0x01 for CONNECT)
• DSTPORT: Destination Port
• DSTIP: Destination IP Address
• USERID: User ID (variable length, null-terminated)

For SOCKS4a, if DSTIP is 0.0.0.X (where X is non-zero), the actual domain name is appended after the NULL byte following USERID.

SOCKS5 Protocol

SOCKS5 is the current standard and a significant enhancement over SOCKS4, offering greater flexibility and features.

Core Functionality

SOCKS5 supports both TCP and UDP traffic. This dual capability makes it suitable for a broader range of applications, including those requiring real-time communication. It also introduces a negotiation phase for authentication methods, allowing for more secure proxy usage.

Key Enhancements

• TCP and UDP Support: SOCKS5 can proxy both TCP and UDP connections. UDP support is crucial for applications like VPNs (when using UDP-based tunnels), online gaming, live streaming, and DNS queries (if using a UDP-based DNS resolver).
• Authentication Methods: SOCKS5 supports multiple authentication methods, enhancing security. Common methods include:
  • No Authentication (0x00): Similar to SOCKS4, no credentials are required.
  • Username/Password (0x01): Clients provide a username and password to the proxy for verification.
  • GSS-API (0x02): A more robust, extensible security mechanism typically used in enterprise environments.
• IPv4 and IPv6 Support: SOCKS5 natively supports both IPv4 and IPv6 addressing, making it future-proof and compatible with modern network infrastructures.
• Server-Side DNS Resolution: Clients can send a domain name directly to the SOCKS5 proxy, which then performs the DNS resolution. This offloads the resolution task from the client and can sometimes improve privacy by preventing local DNS queries.
• Extended Commands: SOCKS5 supports three primary commands:
  • CONNECT (0x01): Establishes a TCP connection to a destination.
  • BIND (0x02): Used for protocols where the server needs to initiate a connection back to the client (e.g., some FTP modes). The proxy listens for an incoming connection on behalf of the client.
  • UDP ASSOCIATE (0x03): Establishes a UDP relay, allowing the client to send and receive UDP packets through the proxy.

SOCKS5 Request Structure (Conceptual)

SOCKS5 involves an initial negotiation phase for authentication, followed by the actual connection request.

Authentication Negotiation (Client to Proxy)

+----+----------+----------+
| VER | NMETHODS | METHODS  |
+----+----------+----------+
  1       1       1 to 255

• VER: Protocol Version (0x05 for SOCKS5)
• NMETHODS: Number of authentication methods supported by the client
• METHODS: List of supported authentication methods

Authentication Response (Proxy to Client)

+----+--------+
| VER | METHOD |
+----+--------+
  1      1

• VER: Protocol Version (0x05)
• METHOD: Selected authentication method (0xFF if no acceptable method)

Connection Request (Client to Proxy)

+----+-----+-------+------+----------+----------+
| VER | CMD |  RSV  | ATYP | DST.ADDR | DST.PORT |
+----+-----+-------+------+----------+----------+
  1     1      1      1     variable      2

• VER: Protocol Version (0x05)
• CMD: Command (0x01 for CONNECT, 0x02 for BIND, 0x03 for UDP ASSOCIATE)
• RSV: Reserved (0x00)
• ATYP: Address Type (0x01 for IPv4, 0x03 for Domain Name, 0x04 for IPv6)
• DST.ADDR: Destination Address (variable length based on ATYP)
• DST.PORT: Destination Port

SOCKS4 vs SOCKS5: Key Differences

Feature	SOCKS4	SOCKS5
Protocol Version	4	5
TCP Support	Yes	Yes
UDP Support	No	Yes
Authentication	No built-in authentication	Yes (No Auth, Username/Password, GSS-API, etc.)
IPv4 Support	Yes	Yes
IPv6 Support	No	Yes
DNS Resolution	Client-side (SOCKS4a allows proxy-side)	Proxy-side (can also be client-side)
Address Types	IPv4 (and domain names with SOCKS4a)	IPv4, IPv6, Domain Name
Commands	CONNECT	CONNECT, BIND, UDP ASSOCIATE
Security	Lower (due to lack of authentication)	Higher (due to authentication options)

Which Protocol to Choose

The choice between SOCKS4 and SOCKS5 depends on specific application requirements, network environment, and security considerations.

When to Choose SOCKS4

SOCKS4 is generally considered legacy. Its use is limited to specific scenarios:

• Legacy Systems: When working with older client applications or proxy servers that only support SOCKS4.
• Simplicity: For extremely simple proxying needs where UDP, IPv6, and authentication are strictly unnecessary, SOCKS4 offers a marginally simpler implementation (though the performance difference is negligible).
• Minimal Overhead: While the overhead difference is minimal in practice, SOCKS4 has a slightly simpler handshake.

In most modern contexts, SOCKS4 is not the preferred choice due to its limitations.

When to Choose SOCKS5

SOCKS5 is the recommended choice for almost all contemporary use cases due to its superior capabilities and flexibility:

• UDP Traffic: Essential for applications requiring UDP, such as:
  • Online gaming
  • Voice over IP (VoIP)
  • Video conferencing and streaming
  • Peer-to-peer (P2P) file sharing
  • DNS queries (if forwarded via proxy)
• Authentication Requirements: If the proxy service requires user authentication for access control and security, SOCKS5's built-in authentication methods are indispensable.
• IPv6 Connectivity: For environments that utilize or require IPv6, SOCKS5 provides native support, ensuring compatibility with future network infrastructure.
• Server-Side DNS Resolution: If the client prefers the proxy to handle DNS resolution (e.g., to potentially mask the client's local DNS queries or for convenience), SOCKS5 offers this capability.
• Modern Applications: Most modern software and operating systems that support SOCKS proxies will support SOCKS5.
• Flexibility and Future-Proofing: SOCKS5 offers a more robust and versatile solution that is better equipped to handle diverse and evolving network requirements.

Practical Considerations

When integrating SOCKS proxies, consider the following:

• Security: Neither SOCKS4 nor SOCKS5 encrypts the data payload itself. They primarily facilitate the connection. For secure communication, ensure that the application traffic itself is encrypted (e.g., using TLS/SSL for HTTPS traffic, or by tunneling the SOCKS connection through a VPN).
• Application Support: Verify that the client application or operating system configuration supports the chosen SOCKS protocol version. Most modern applications default to SOCKS5 if available.
• Performance: The performance difference between SOCKS4 and SOCKS5 is generally negligible for typical TCP connections. The overhead introduced by SOCKS5's negotiation and authentication is minimal. The primary performance factor will be the network latency and bandwidth between the client, proxy, and target server.
• Configuration: Configuring a SOCKS proxy usually involves specifying the proxy server's IP address or hostname, the port, and for SOCKS5, potentially authentication credentials.

# Example application configuration (conceptual)
proxy_type = SOCKS5
proxy_host = proxy.example.com
proxy_port = 1080
proxy_username = myuser
proxy_password = mypassword

The selection of SOCKS5 over SOCKS4 is a clear preference for modern networking, offering a broader feature set and improved security capabilities for a wide array of applications.