Select the authentication method
01SOCKS5 chooses an authentication method before sending credentials. The outer protocol version and this method’s subnegotiation version are different fields.
Separate failure branch: proxy selects FF. Under RFC 1928 §3 the client MUST close, without sending credentials.
Source for this drawing: RFC 1929 · Read RFC section 1 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Offer a method, wait for the server’s selection, then begin that method’s exchange.
- RFC 1929 defines one authentication subnegotiation inside SOCKS V5 (§1). RFC 1928 §3 supplies the preceding method-selection exchange. SOCKS is a proxy protocol; this publication does not define all proxy commands.
- The client first opens a TCP connection to the SOCKS server. Our chosen greeting bytes are 05 01 02: outer version 05, one method, username/password method 02 (1928 §3). It does not send a password in this greeting.
- The server selects one of the offered methods. Response 05 02 selects username/password. Only after selection does the client send the RFC 1929 request, whose version byte is 01 (§2). Outer 05, method 02 and subnegotiation 01 must not be confused.
- If no offered method is acceptable, response 05 FF makes the client MUST close the connection (1928 §3). This is a method-selection failure, distinct from a later RFC 1929 authentication failure, where the server MUST close.
- RFC 1928 §3 says compliant implementations MUST support GSSAPI and SHOULD support username/password. This guide’s one-method greeting is a chosen exchange to isolate method 02; it is not a complete SOCKS implementation or an assertion that other support requirements disappear.
Hexadecimal byte values; this chosen greeting offers only method 02. The final state is a separate rejected negotiation, not an extra message after a successful selection.
Read the RFC section ↗