A SOCKS4 proxy is an old, relatively simple type of proxy server that facilitates network traffic between a client and a server. It acts as an intermediary, allowing clients to establish TCP connections to other servers through the proxy, particularly useful for getting around firewalls or geographical restrictions, or for anonymizing connections.

The term “SOCKS” stands for “SOCKetS”, referring to the fact that it operates at the session layer (Layer 5) of the OSI model, just above the transport layer (TCP/UDP), providing a generic way to proxy arbitrary TCP connections.

How a SOCKS4 Proxy Works:

SOCKS4 is specifically designed to handle TCP connections only. It does not natively support UDP. Here’s the basic workflow:

1. Client Connects to SOCKS4 Proxy: The client (e.g., a web browser configured to use a SOCKS4 proxy) first establishes a TCP connection to the SOCKS4 proxy server on a specific port (e.g., 1080, though it can be any port).

2. Client Sends SOCKS4 Request: Once the connection is established, the client sends a SOCKS4 request to the proxy. This request specifies:

   • The SOCKS version (4).

   • The command it wants to execute (typically CONNECT for establishing a connection).

   • The destination IP address of the target server it wants to reach (e.g., 192.0.2.1 for www.example.com).

   • The destination port of the target server (e.g., 80 for HTTP, 443 for HTTPS).

   • A user ID (optional, and usually ignored by SOCKS4 servers for authentication).

   • Crucially, SOCKS4 does NOT support domain names in the request; it requires an IP address. This means the client must perform the DNS resolution itself before sending the request to the SOCKS4 proxy.

3. Proxy Connects to Target Server:

   • The SOCKS4 proxy receives the request.

   • It then attempts to establish a new TCP connection to the specified destination IP address and port on behalf of the client.

4. Proxy Sends SOCKS4 Response:

   • If the proxy successfully connects to the target server, it sends a success response back to the client.

   • If the connection fails (e.g., target server unreachable, connection refused), it sends an error response.

5. Data Relaying:

   • Once a successful connection is established between the client, proxy, and target server, the SOCKS4 proxy transparently relays all data between the client and the target server.

   • The client’s traffic appears to originate from the proxy server’s IP address to the target server.

Key Characteristics and Limitations of SOCKS4:

• TCP Only: SOCKS4 is limited to proxying TCP connections. It cannot proxy UDP traffic.

• No Authentication (effectively): While the SOCKS4 request includes a “user ID” field, SOCKS4 itself doesn’t define strong authentication mechanisms. Many SOCKS4 servers ignore this field or implement very basic, non-standard authentication. This makes it less secure.

• No DNS Resolution by Proxy: As mentioned, the client must resolve domain names to IP addresses before sending the request to the SOCKS4 proxy. This can sometimes leak DNS queries, depending on how the client is configured.

• No UDP Support: This means it cannot be used for many modern applications that rely on UDP, such as VoIP, online gaming, or certain streaming protocols.

• No IPv6 Support: SOCKS4 was designed for IPv4.

• No Encryption: SOCKS4 does not provide any encryption for the traffic passing through it. Data is relayed in plaintext unless the application itself uses encryption (e.g., if you’re using SOCKS4 to proxy an HTTPS connection, the HTTPS encryption is handled by the client and target server, not the proxy).

When Was SOCKS4 Used (and Why it’s Less Common Now):

SOCKS4 was primarily used in the past for:

• Bypassing Firewalls: If a firewall blocked direct access to certain ports or external servers, but allowed connections to a SOCKS4 proxy, clients could use the proxy to tunnel through the firewall.

• Simple Anonymity: The target server sees the proxy’s IP address, not the client’s original IP. However, due to its lack of authentication and security features, it’s not considered a strong privacy tool.

SOCKS4 is largely considered obsolete today due to its limitations, particularly the lack of UDP support, strong authentication, and modern security features. It has been largely superseded by:

• SOCKS5: The much more capable successor.

• HTTP Proxies: Especially for web traffic.

SOCKS4 vs. SOCKS5:

While you might still encounter SOCKS4 support in some older software or niche scenarios, SOCKS5 is the de facto standard for general-purpose SOCKS proxying today because of its enhanced capabilities and security features.