While I was reading an article about proxy chaining


I've stumbled upon this paragraph

Even if you use proxy chaining you can’t be 100% anonymous. You could be traced on the basis of each proxy used to establish a connection. It just makes it a lot harder to track. If you use foreign proxies, then it will be more complicated to find someone. Tracking could be done only by collecting the logs of each proxies used from the administrator. This could take a lot of time if we use a foreign proxy.

I'm not sure if i understand that correctly but from what I know about the workings of SOCKS proxies, they are raw TCP connections that relay the TCP stream to the specified address. With that in mind, consider this example:

I want to connect to someserver.com but lets say due to censorship I cannot do that openly because the ISP will give me trouble, now I want to connect to that server through a proxy chain (consisting of 3 socks5 proxies)

This will look something like this

ME -> (ISP) -> P1 -> P2 -> P3 -> someserver.com

In this situation someserver.com sees me (my IP) as P3 which is expected, but my ISP should see me connect to P1, P2 and P3 due to SOCKS5 beeing raw TCP so in theory they can clearly see where I am connecting because all the plain TCP connections are made through them and are unencrypted.

Why would the ISP had to get logs from all the proxies to know where I'm connecting if according to what I wrote above they should already know that?

1 Answer 1


With a regular SOCKS proxy, you're absolutely right. Unless your ISP is only looking at the immediate destination of your packets (which is unlikely), they would immediately see right through it all. That article is only true if the links are encrypted somehow (like Tor does automatically, for example).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .