SOCKS4 vs SOCKS5: the differences that matter
SOCKS4 and SOCKS5 both relay TCP, but only SOCKS5 does UDP, IPv6, authentication and remote DNS. What each difference means and which to choose.
By bribe · Updated
SOCKS is a protocol for relaying network connections through another machine. The client tells the proxy where it wants to go, the proxy opens the connection, and from then on it copies bytes in both directions without looking at what they mean. That makes SOCKS work for any application protocol, unlike an HTTP proxy.
Two versions are in use. SOCKS4 dates from the early 1990s; SOCKS5 was standardised in RFC 1928 in 1996.
The four differences
1. UDP
SOCKS4 relays TCP only. SOCKS5 adds UDP ASSOCIATE, so DNS queries, QUIC, voice and many games can go through it. Note that plenty of public SOCKS5 servers do not actually implement UDP.
2. Who resolves the hostname
With SOCKS4 the client must send an IP address, so your own machine looks up example.com first and your DNS resolver sees every site you visit. SOCKS4a and SOCKS5 can send the hostname instead and let the proxy resolve it. In curl and Python, socks5h:// means “let the proxy resolve”; socks5:// resolves locally.
3. Authentication
SOCKS4 only carries a user ID string, which is not a password. SOCKS5 supports username and password (RFC 1929) and GSSAPI.
4. IPv6
SOCKS4 addresses are four bytes, so IPv6 targets are impossible. SOCKS5 handles IPv4, IPv6 and hostnames.
What neither does
Neither version encrypts traffic. If you connect to an https:// site through either, TLS protects the content end to end; if you connect to plain http://, the proxy operator can read it.
Which one to use
SOCKS5, whenever the client supports it. Choose SOCKS4 only for software that cannot speak SOCKS5, and accept the local DNS lookups. Both lists are on ProxySpace: SOCKS5 and SOCKS4. The protocol comparison puts HTTP and HTTPS proxies next to them.