SOCKS4a proxy

SOCKS4a Proxy

What is SOCKS4a

SOCKS4a is an extension of the SOCKS4 protocol, proposed by Ying-Da Lee. The key difference from the original SOCKS4 is that the client can send a domain name instead of an IP address, and DNS resolution occurs on the proxy server side.

In standard SOCKS4, the client must resolve the domain name to an IP address itself before sending the request. This creates a problem: the DNS query goes directly from the client, revealing information about the websites being visited. SOCKS4a solves this issue.

The SOCKS4 DNS Problem

How SOCKS4 Works

1. The client wants to connect to example.com
2. The client makes a DNS query directly (not through the proxy)
3. It receives IP 93.184.216.34
4. It sends a command to the proxy: "connect to 93.184.216.34:80"
5. The proxy establishes a TCP connection

Problem: The DNS query in step 2 is visible to the ISP, the DNS server, and anyone monitoring the traffic. This is a DNS leak.

How SOCKS4a Works

1. The client wants to connect to example.com
2. The client sends a command to the proxy: "connect to example.com:80"
3. The proxy itself resolves example.com to an IP
4. The proxy establishes a TCP connection

The DNS query is completely hidden behind the proxy.

Technical Implementation

SOCKS4 Request Format

SOCKS4a Request Format

The format is the same, but with a trick: the DSTIP field contains an invalid IP of the form 0.0.0.x (where x > 0). After the USERID's NULL terminator, the domain name is appended:

The proxy sees an IP of the form 0.0.0.x and understands that a domain name for resolution follows after the USERID.

SOCKS4 vs SOCKS4a vs SOCKS5

Advantages of SOCKS4a

1. Eliminates DNS Leak

The main advantage is that the client does not make DNS queries directly. All DNS activity is hidden behind the proxy.

2. Protocol Simplicity

SOCKS4a is simpler to implement than SOCKS5. There is no authentication phase, no UDP support — only TCP CONNECT.

3. Backward Compatibility

A SOCKS4a client can work with a SOCKS4a proxy, and the request format is backward compatible with SOCKS4.

4. Access to .onion and Internal Domains

Since DNS is resolved on the proxy side, SOCKS4a can be used to access domains that are not resolved by public DNS (e.g., .onion via Tor).

Limitations

1. No Authentication

SOCKS4a does not support authentication. Anyone who knows the proxy address can use it.

2. No UDP

Only TCP connections are supported. DNS queries, VoIP, and gaming traffic via UDP are not supported.

3. No IPv6

The DSTIP field is 4 bytes, only for IPv4.

4. Obsolete Protocol

SOCKS5 superseded SOCKS4a, providing all its capabilities plus authentication, UDP, and IPv6.

When to Use SOCKS4a

• Legacy systems — older software that does not support SOCKS5
• Simple scenarios — when authentication and UDP are not needed
• Tor connections — Tor supports SOCKS4a for .onion resolution
• Minimal overhead — when minimal protocol latency is important

Software Support

Conclusion

SOCKS4a was an important evolutionary step from SOCKS4, solving the problem of DNS leaks. Although SOCKS5 is the standard today, understanding SOCKS4a is useful for working with legacy systems and for comprehending the evolution of proxy protocols.