SOCKS facts for kids

Kids Encyclopedia Facts

SOCKS is a special way for computers to talk to each other on the Internet. It's like a helpful middleman, called a proxy server, that sends information between your computer (the client) and another computer (the server).

Imagine you want to send a message to a friend, but you want it to go through a trusted helper first. SOCKS does that for your computer's messages, called network packets.

The newest version, SOCKS5, can also check who you are (this is called authentication). This means only people who are allowed can use the server. SOCKS servers usually handle connections that let you browse the web or send data. They often use a specific "door" on the internet called TCP port 1080.

How SOCKS Started
What Does SOCKS Mean?
How SOCKS Is Used
How SOCKS Protocols Work
Software That Uses SOCKS
Security Concerns
See also

How SOCKS Started

The SOCKS protocol was first created by a person named David Koblas. He was a system administrator at a company called MIPS Computer Systems. In 1992, after his company was bought by Silicon Graphics, David shared his work on SOCKS at a computer security meeting. This made SOCKS available for everyone to use.

Later, another person named Ying-Da Lee from NEC helped improve the protocol, making it version 4. The SOCKS5 protocol, which is a more advanced version, was approved in 1996. It was designed to help make firewalls and other security tools easier to manage.

What Does SOCKS Mean?

Sometimes, people say SOCKS stands for "socket secure." This idea started around 2001. However, when SOCKS was first created in 1992 and when SOCKS5 was officially defined in 1996, it wasn't given a specific meaning like that. It was just the name for a special way to connect computers through a firewall.

How SOCKS Is Used

SOCKS is a very common way for computers to connect through a "circuit-level gateway." Think of it as a versatile tool that can forward almost any kind of internet traffic.

Here are some ways SOCKS can be used:

Bypassing Internet Filters: SOCKS can help you access websites or online content that might be blocked. This can happen in places like schools, workplaces, or even in some countries. It helps your internet traffic go around these blocks.
- For example, the Tor network, which helps people stay anonymous online, uses a SOCKS connection for its users.
Creating Secure Connections: SOCKS can work a bit like a virtual private network (VPN). It helps connect your computer to a server's "local" network.
- Some secure connection tools, like OpenSSH, can create a local SOCKS proxy. This means you can connect to many different places through one secure link.

How SOCKS Protocols Work

SOCKS uses different versions, like SOCKS4, SOCKS4a, and SOCKS5. Each version has its own way of setting up a connection.

SOCKS4 Basics

When your computer wants to connect using SOCKS4, it sends a request to the SOCKS server. This request includes information like:

The SOCKS version number (which is 0x04 for SOCKS4).
What command it wants to do (like connecting or binding a port).
The port number it wants to connect to.
The IP address of the computer it wants to reach.
Your user ID.

The server then sends a reply back. This reply tells your computer if the request was successful or if it failed.

First message to server
	VER	CMD	DSTPORT	DSTIP	ID
Byte Count	1	1	2	4	Variable

VER: SOCKS version number (0x04 for SOCKS4).
CMD: What your computer wants to do (like connect or bind).
DSTPORT: The port number to connect to.
DESTIP: The IP address of the computer you want to reach.
ID: Your user ID.

Reply message from server
	VN	REP	DSTPORT	DSTIP
Byte Count	1	1	2	4

VN: Reply version.
REP: The code that tells you if the request worked or failed.

Code	Meaning
0x5A	Request granted (it worked!)
0x5B	Request rejected or failed
0x5C	Request failed because your computer's ID service wasn't working
0x5D	Request failed because your computer's ID service couldn't confirm your user ID

DSTPORT: The destination port.
DSTIP: The destination IP address.

SOCKS4a for Domain Names

SOCKS4a is an improvement on SOCKS4. It lets your computer use a domain name (like "example.com") instead of just an IP address (like "192.168.1.1"). This is helpful if your computer can't figure out the IP address from the domain name itself.

With SOCKS4a, your computer sends a special IP address (0.0.0.x, where x is not zero) and then sends the domain name. The SOCKS server then figures out the IP address and makes the connection.

SOCKS5: More Options and Security

SOCKS5 is a newer and more powerful version. It's different from SOCKS4. SOCKS5 offers more ways to check who you are (authentication). It also supports newer internet addresses (IPv6) and a different way of sending data called UDP. UDP is often used for things like looking up website names (DNS lookups).

The connection process for SOCKS5 starts with a "greeting."

Your computer sends a greeting to the server, listing the ways it can prove who it is.
The server picks one of these ways or says it can't find a match.
Then, depending on the chosen method, your computer and the server might exchange more messages to confirm your identity.
Finally, your computer sends its connection request, and the server responds.

SOCKS5 can use different ways to authenticate, like a simple username and password.

Client greeting
	VER	NAUTH	AUTH
Byte count	1	1	variable

VER: SOCKS version (0x05).
NAUTH: How many authentication methods your computer supports.
AUTH: The list of authentication methods.

Server choice
	VER	CAUTH
Byte count	1	1

VER: SOCKS version (0x05).
CAUTH: The authentication method the server chose, or 0xFF if none worked.

After authentication, your computer sends a connection request. This request includes:

The SOCKS version (0x05).
The command (like connect, bind, or associate a UDP port).
The destination address (which can be an IPv4, IPv6, or domain name).
The destination port.

The server then sends a response, telling you if the request was granted or why it failed.

Client connection request
	VER	CMD	RSV	DSTADDR	DSTPORT
Byte Count	1	1	1	Variable	2

VER: SOCKS version (0x05).
CMD: What your computer wants to do (connect, bind, or associate UDP).
RSV: Reserved (must be 0x00).
DSTADDR: The address you want to reach.
DSTPORT: The port number.

Response message from server
	VER	STATUS	RSV	BNDADDR	BNDPORT
Byte Count	1	1	1	variable	2

VER

SOCKS version (0x05).

STATUS

The code that tells you if the request worked or failed.

0x00: Request granted (it worked!).
0x01: General failure.
0x02: Connection not allowed.
0x03: Network unreachable.
0x04: Host unreachable.
0x05: Connection refused by the destination.
0x06: Time limit expired.
0x07: Command not supported or protocol error.
0x08: Address type not supported.

RSV: Reserved (must be 0x00).
BNDADDR: The address the server used.
BNDPORT: The port the server used.

Sometimes, you might see "socks5h" mentioned. This just means it's a SOCKS5 connection where a domain name is used instead of an IP address. "socks5" usually means an IP address is used. A similar idea exists for SOCKS4 and SOCKS4a.

Software That Uses SOCKS

SOCKS Proxy Servers

Many programs can act as SOCKS proxy servers, helping to route internet traffic.

Sun Java System Web Proxy Server is a server that can handle SOCKSv5 connections.
WinGate is a proxy server for Windows that supports SOCKS4, SOCKS4a, and SOCKS5.
Socksgate5 is a special firewall that can inspect SOCKS traffic.
Dante is a SOCKS server that provides secure network connections.
HevSocks5Server is a fast SOCKS server for Unix-like systems.

Other Programs Providing SOCKS Server Features

Some other programs can also create SOCKS connections or tunnels.

OpenSSH allows you to create secure tunnels using a part of the SOCKS protocol.
PuTTY is a program for Windows that can create SOCKS tunnels through secure SSH servers.
Secure ShellFish is an SSH client for iOS and macOS that includes a SOCKS server.
ShimmerCat is a web server that uses SOCKS5 to pretend it's on an internal network.
Tor provides a SOCKS server connection for its users.
Shadowsocks is a tool used to get around internet censorship, and it offers a SOCKS5 connection.
netcat tools like Ncat and socat can also work with SOCKS.

Client Software

For your applications to use SOCKS, they usually need to have built-in support for it.

Web Browsers

Chrome: Supports SOCKS4, SOCKS4a, and SOCKS5.
Firefox: Supports SOCKS4, SOCKS4a, and SOCKS5.
Internet Explorer and older Microsoft Edge (EdgeHTML-based): Only support SOCKS4.
Newer Microsoft Edge (Chromium-based): Supports SOCKS4, SOCKS4a, and SOCKS5.

Socksifiers

Socksifiers are programs that let other applications use a proxy even if those applications don't have built-in proxy support. They often do this by creating a virtual network connection.

Proxifier is a program for Windows and macOS that can force applications to use a SOCKS proxy.
tun2socks is an open-source tool that helps create virtual connections from a SOCKS proxy.
proxychains is a Unix program that forces TCP traffic through SOCKS or HTTP proxies.

Translating Proxies

These are proxies that can change one type of proxy connection into another.

Polipo was a proxy server that could forward and cache HTTP/1.1 traffic.
Privoxy is a proxy that converts SOCKS connections to HTTP.
Tinyproxy is a small HTTP/HTTPS proxy that can connect to SOCKS4/5 and HTTP proxies.

Security Concerns

SOCKS connections usually don't encrypt the information they send. This means that someone could potentially spy on your internet traffic or even change it. This lack of encryption can make SOCKS connections vulnerable to certain types of attacks and could allow governments or other groups to monitor what you do online.