Visual RFC.
ALL RFCs / RFC 1928
Read the RFC ↗
RFC 1928 / SOCKS PROXY RELAY

Negotiate a method before requesting a relay

01

The application connects to a SOCKS server and offers methods. The server chooses a method before the application requests any target.

DIAGRAMRead RFC section 3 ↗
RFC 1928 · § 3EXAMPLE
4 / 4
Negotiate a method before requesting a relayFour method-negotiation scenes over an already opened client-to-proxy TCP connection. Client offers05 02 00 02, then proxy returns05 00 choosing no authentication for this example, without opening a target. The no-auth stage then permits a separate relay request; other methods require their own subnegotiation and protection. An independent05 FF rejection travels proxy to client, which MUST close before any relay request. The method reply is not a CONNECT reply and this is not an encrypted or authenticated session.Negotiate methods before any target requestClientSOCKSproxy → client: 05 FFsend relay requestClient MUST close TCPSeparate no-acceptable-method branch
04
Close when no method is acceptable.

Separate failure branch:05 FF travels proxy to client. The client MUST close; it must not send a CONNECT request on that failed negotiation.

Source for this drawing: RFC 1928 · Read RFC section 3 ↗

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
New to this? Start hereA quick picture + helpful background

A request starts a conversation.

A client asks for a resource. A server sends a response. The method, address, headers, and status explain what that conversation means.

Helpful first, if these ideas are unfamiliar

RFC 9293 TCP RFC 768 UDP RFC 8200 IPv6

These pictures are analogies to help you learn. The linked RFC explains the actual rules.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

KEY POINT

A method choice is not a target connection.

  • The greeting contains VER=05, NMETHODS and that many method octets. The server selects a method from the offered list; its reply is VER and METHOD, not a CONNECT reply.
  • Method00 means no authentication required;01 is GSSAPI and02 username/password. If METHOD is FF, none is acceptable and the client MUST close the connection.
  • Complete any method-specific subnegotiation before the relay request. Compliant implementations MUST support GSSAPI and SHOULD support username/password under RFC1928; the no-auth illustration is one chosen session, not a complete compliant implementation.
DETAILS

An octet is an eight-bit byte; displayed byte values are hexadecimal. TCP port1080 is conventional, not an enforced universal port. GSSAPI is the Generic Security Service Application Program Interface; method details are in separate RFC1961/1929. Confidentiality and integrity depend on the chosen method and any separate application protection. No real authentication, credentials or network service is used.

Read the RFC section ↗

All chapters in RFC 1928

Drawing view

Scroll the drawing to see every part. Playback controls stay above it.

RFC 9700 / CHAPTERS

Chapters

For full details, tables, algorithms, and exceptions, read the original RFC.

RFC status and corrections ↗