What Is SOCKS5? – Definition and How It Works

Learn what the SOCKS5 protocol is, how it differs from an HTTP proxy, how remote DNS resolution works, and when to choose it.

SOCKS5 is a proxy protocol that forwards raw connections. Unlike an HTTP proxy, it does not understand or inspect the traffic passing through it, which makes it protocol-agnostic.

1. What Is SOCKS5?

A session-layer proxy that relays TCP connections and UDP datagrams.

• Key idea: the proxy forwards bytes without interpreting them.
• Mechanism: the client negotiates authentication, names a destination, and the proxy opens the connection and relays.
• Goal: proxy any protocol, not just HTTP.

2. The Handshake

1. The client connects and offers the authentication methods it supports.
2. The proxy selects one — commonly none, or username and password.
3. Credentials are exchanged if required.
4. The client sends a connect request naming the destination host and port.
5. The proxy opens the connection and relays bytes in both directions.

The destination can be an address or a hostname, which is what enables remote DNS.

3. SOCKS5 Versus HTTP Proxy

An HTTP proxy can inspect and modify requests, which is useful for caching and filtering. SOCKS5 cannot, which is exactly why it works for protocols it was never designed around.

4. Remote DNS Matters

If the client resolves the hostname locally and connects to the resulting address, the local resolver sees every destination — a leak that undermines the point of proxying.

SOCKS5 allows the hostname to be sent to the proxy, which resolves it remotely. Many clients default to local resolution, so this is usually an explicit setting: in curl, socks5h:// requests remote resolution while socks5:// does not.

5. Authentication and Encryption

SOCKS5 supports username and password authentication, transmitted without encryption by the protocol itself. The protocol adds no confidentiality at all.

Anything sensitive must be encrypted at a higher layer — which, for web traffic, TLS already provides end to end through the proxy.

6. Where SOCKS5 Fits

• Proxying non-HTTP protocols: database clients, mail, SSH, custom TCP services.
• Routing a whole application's traffic where an HTTP proxy setting does not exist.
• Cases where remote DNS resolution is required.
• Tunnelling over an SSH connection, which exposes a local SOCKS5 endpoint.

For plain web scraping over HTTPS, an HTTP proxy is equally capable, and support in HTTP client libraries is more uniform.

7. Common Misconceptions

• "SOCKS5 encrypts traffic." It does not. TLS does.
• "SOCKS5 is faster." Overhead differences are marginal; the network path dominates.
• "SOCKS5 is more anonymous." Only in the DNS sense, and only when remote resolution is actually enabled.
• "Every library supports it." Support is common but not universal, and often needs an extra dependency.

8. Summary

SOCKS5 relays connections without interpreting them, handling any TCP protocol and optionally UDP, with authentication and the ability to resolve destination names at the proxy.

Choose it for non-HTTP traffic or when remote DNS is required. For ordinary HTTPS collection, an HTTP proxy is simpler to configure and just as effective — and neither provides encryption of its own.

Potential Related Glossary

• IP Rotation
• Residential Proxies
• Parsing
• Web Crawling