{"record":{"id":"5723fef4af8af962","repo":"XTLS/Xray-core","slug":"tcp-bind-is-not-supported","errorCode":null,"errorMessage":"TCP bind is not supported.","messagePattern":"TCP bind is not supported\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/socks/protocol.go","lineNumber":179,"sourceCode":"\t}\n\n\trequest := new(protocol.RequestHeader)\n\tif username != \"\" {\n\t\trequest.User = &protocol.MemoryUser{Email: username}\n\t}\n\tswitch cmd {\n\tcase cmdTCPConnect, cmdTorResolve, cmdTorResolvePTR:\n\t\t// We don't have a solution for Tor case now. Simply treat it as connect command.\n\t\trequest.Command = protocol.RequestCommandTCP\n\tcase cmdUDPAssociate:\n\t\tif !s.config.UdpEnabled {\n\t\t\twriteSocks5Response(writer, statusCmdNotSupport, net.AnyIP, net.Port(0))\n\t\t\treturn nil, nil, errors.New(\"UDP is not enabled.\")\n\t\t}\n\t\trequest.Command = protocol.RequestCommandUDP\n\tcase cmdTCPBind:\n\t\twriteSocks5Response(writer, statusCmdNotSupport, net.AnyIP, net.Port(0))\n\t\treturn nil, nil, errors.New(\"TCP bind is not supported.\")\n\tdefault:\n\t\twriteSocks5Response(writer, statusCmdNotSupport, net.AnyIP, net.Port(0))\n\t\treturn nil, nil, errors.New(\"unknown command \", cmd)\n\t}\n\n\trequest.Version = socks5Version\n\n\taddr, port, err := addrParser.ReadAddressPort(nil, reader)\n\tif err != nil {\n\t\treturn nil, nil, errors.New(\"failed to read address\").Base(err)\n\t}\n\trequest.Address = addr\n\trequest.Port = port\n\n\tresponseAddress := s.address\n\tresponsePort := s.port\n\tvar tempUDPConn *TempUDPConn\n\t//nolint:gocritic // Use if else chain for clarity","sourceCodeStart":161,"sourceCodeEnd":197,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/proxy/socks/protocol.go#L161-L197","documentation":"Thrown in handshake5 (proxy/socks/protocol.go:179) when the SOCKS5 command byte is 0x02 (BIND). The server answers statusCmdNotSupport: Xray's SOCKS inbound deliberately implements only CONNECT and UDP ASSOCIATE; inbound BIND (accepting a reverse connection) is not supported.","triggerScenarios":"A SOCKS5 client issues CMD=0x02, typically FTP active-mode data connections, some IRC DCC setups, or older P2P software.","commonSituations":"FTP clients configured for active mode through the proxy; applications assuming full RFC 1928 command coverage.","solutions":["Switch the application to passive/extended-passive mode (FTP PASV/EPSV), which only needs CONNECT.","If a listener is truly required, use Xray's dedicated inbound types (dokodemo-door / port forwarding) instead of SOCKS BIND.","Verify the command byte is not corrupted by bad client framing."],"exampleFix":"# before: FTP active mode through SOCKS triggers BIND\ncurl --ftp-port - -x socks5h://127.0.0.1:1080 ftp://example.com/file\n\n# after: passive mode only uses CONNECT\ncurl -P - -x socks5h://127.0.0.1:1080 ftp://example.com/file  # or just default passive mode\ncurl -x socks5h://127.0.0.1:1080 ftp://example.com/file","handlingStrategy":"validation","validationCode":"// Client-side: reject BIND up front instead of round-tripping\nconst sock5Bind = 0x02\nif desiredCmd == sock5Bind {\n    return fmt.Errorf(\"Xray SOCKS inbound does not support BIND; use passive mode or port forwarding\")\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"TCP bind is not supported\") {\n    return ErrUnsupportedOperation // switch app to passive mode\n}","preventionTips":["Configure FTP for passive mode when proxied.","Use dokodemo-door or direct exposure for services needing listeners."],"tags":["socks","socks5","unsupported-command","bind","xray"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}