Once connected to the SOCKS server, the client can send a CONNECT request to establish a connection to an application server. This request has different format in the SOCKS4 and SOCKS5 protocols. The first byte in such a request can be used to differentiate the protocol version.

SOCKS5 Connect Request

Once the authentication negotiation has completed successfully, the following CONNECT request should be encapsulated according to the authentication method with the following format:

+----+-----+-------+------+----------+----------+
|VER | CMD |  RSV  | ATYP | DST.ADDR | DST.PORT |
+----+-----+-------+------+----------+----------+
  1     1    `0x00`    1     Variable      2

where:

Destination address

The valid destination addresses types ATYP are the following:

If ATYP represents a domain name, the first octet of DST.ADDR determines its length. DST.ADDR should have no terminating NULL octet.

SOCKS4 Connect Request

The client includes the IP address and the port number of the destination host, and a userid, in the following format:

+-----+-----+----+----+----+----+----+----+----+----+....+----+
| VER | CMD | DSTPORT |      DSTIP        | USERID       |NULL|
+-----+-----+----+----+----+----+----+----+----+----+....+----+
   1     1       2              4           variable       1

where:

SOCKS4A Domain names

In SOCKS Protocol Version 4A, a CONNECT request can also include the application server domain name instead of relying on its IP address. In that case, DSTIP should consist of three NULL bytes and a non-zero value.

The corresponding IP address in DSTIP (0.0.0.x) becomes inadmissible and the application domain name should be attached after the NULL byte, with its own NULL byte.

+-----+-----+----+----+----+----+----+----+----+----+....+----+----+----+....+----+
| VER | CMD | DSTPORT |       DSTIP       | USERID       |NULL|  DOMAIN      |NULL|
|     |     |         |NULL|NULL|NULL|[^0]|              |    |              |    |
+-----+-----+----+----+----+----+----+----+----+----+....+----+----+----+....+----+
   1     1       2              4           variable       1    variable       1

This is useful when the client cannot resolve the destination host's domain name to find its IP address. When DSTIP represents an invalid IP address, the server should resolve the domain name before proxying the requests.

Connect Reply

If the SOCKS server grants the request, it makes a connection to the specified port of the destination host. A reply packet is sent to the client when this connection is established, or when the request is rejected or the operation fails.

SOCKS5 Connect Reply

+----+-----+-------+------+----------+----------+
|VER | REP |  RSV  | ATYP | BND.ADDR | BND.PORT |
+----+-----+-------+------+----------+----------+
  1     1    `0x00`    1     Variable      2

where:

The code REP might have one of the following values:

When a reply from the SOCKS server indicates a failure, the SOCKS server MUST terminate the TCP connection immediately after sending the reply.

If the reply code to a CONNECT request indicates a success (REP is 0x00), the client may now start passing data.

BND.ADDR and BND.PORT contain the address and port the SOCKS server assigned to connect to the target host. Because SOCKS servers might be multi-homed, BND.ADDR might be different from the address the client used to reach the SOCKS server.

SOCKS4 Connect Reply

+-----+-----+----+----+----+----+----+----+
| VER | REP | DSTPORT |      DSTIP        |
+-----+-----+----+----+----+----+----+----+
   1     1      2              4

where:

The code REP might have one of the following values.

Note that, unlike SOCKS5, the SOCKS Protocol Version 4 determines the fields DSTPORT and DSTIP are ignored.

If the request failed, the SOCKS server closes its connection immediately after notifying the client with codes 91, 92, or 93.

When the request is successful, the SOCKS server starts relaying traffic on both directions. Thus, the client can now perform I/O operations on the same connection as if it were directly connected to the application server.

For the CONNECT operation, the server sets a time limit of 2 minutes for the establishment of its connection with the application server. If the connection is still not established when the time limit expires, the server closes its connection to the client and gives up.

SOCKS4 Identification

IPv6/IPv4 Gateway