SOCKS

02 January 2005

SOCKS is an Internet protocol that allows client-server applications to transparently use the services of a network firewall. SOCKS is an abbreviation for "SOCKetS" [1].

Clients behind a firewall wanting to access exterior servers connect to a SOCKS proxy server instead. This proxy server controls the eligibility of the client to access the external server and passes the request on to the server.

The protocol was originally developed by David Koblas and then extended to version 4 by Ying-Da Lee of NEC. The current version 5 of the protocol, RFC 1928, extends the previous version by supporting UDP, authentication and IPv6.

According to the OSI model it is an intermediate layer between the application layer and the transport layer.

SOCKS 4 protocol

A typical SOCKS 4 connection request looks like this (each number is one byte):


Client to Socks Server: |0x04|0x01|0x0050|0x42660763|

field 0: socks version number
field 2: command
field 3: network byte order port number
field 4: network byte order ip address

Server to socks client: |0x00|0x5a|0x0050|0x42660763|

field 0: null byte
field 2: status
field 3: network byte order port number
field 4: network byte order ip address

This is a socks 4 request to connect to 66.102.7.99:80, the server replies with an "OK."

From this point on any data sent from the socks client to the socks server will be relayed to 66.102.7.99 and vice versa.

The command field can be 0x01 for "connect" or 0x02 for "bind."

The status field is 0x5a as an "ack" on success and (0x5a | 1) for a "nack" on failure.