{"record":{"id":"b2b8e65c01c6d429","repo":"XTLS/Xray-core","slug":"unexpected-server-version-version","errorCode":null,"errorMessage":"unexpected server version: {version}","messagePattern":"unexpected server version: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"proxy/socks/protocol.go","lineNumber":461,"sourceCode":"\tif request.User != nil {\n\t\tauthByte = byte(authPassword)\n\t}\n\n\tb := buf.New()\n\tdefer b.Release()\n\n\tcommon.Must2(b.Write([]byte{socks5Version, 0x01, authByte}))\n\tif err := buf.WriteAllBytes(writer, b.Bytes(), nil); err != nil {\n\t\treturn nil, err\n\t}\n\n\tb.Clear()\n\tif _, err := b.ReadFullFrom(reader, 2); err != nil {\n\t\treturn nil, err\n\t}\n\n\tif b.Byte(0) != socks5Version {\n\t\treturn nil, errors.New(\"unexpected server version: \", b.Byte(0)).AtWarning()\n\t}\n\tif b.Byte(1) != authByte {\n\t\treturn nil, errors.New(\"auth method not supported.\").AtWarning()\n\t}\n\n\tif authByte == authPassword {\n\t\tb.Clear()\n\t\taccount := request.User.Account.(*Account)\n\t\tcommon.Must(b.WriteByte(0x01))\n\t\tcommon.Must(b.WriteByte(byte(len(account.Username))))\n\t\tcommon.Must2(b.WriteString(account.Username))\n\t\tcommon.Must(b.WriteByte(byte(len(account.Password))))\n\t\tcommon.Must2(b.WriteString(account.Password))\n\t\tif err := buf.WriteAllBytes(writer, b.Bytes(), nil); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tb.Clear()","sourceCodeStart":443,"sourceCodeEnd":479,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/proxy/socks/protocol.go#L443-L479","documentation":"Thrown by the Xray SOCKS5 client (ClientHandshake) when the first byte of the server's method-selection reply is not 0x05. Per RFC 1928 the SOCKS5 server must reply with version 5; anything else means the remote is not speaking SOCKS5 or is a broken/misbehaving server. Marked AtWarning because it usually indicates a configuration mistake, not a code bug.","triggerScenarios":"Calling a SOCKS5 outbound where server.Destination points at a non-SOCKS5 service: an HTTP proxy port, an HTTPS port (first byte 0x16), a SOCKS4-only server, or a captive-portal HTML response.","commonSituations":"Outbound 'socks' address/port pointing at the wrong service; pointing at a Trojan/VLESS port by mistake; server behind a CDN or load balancer that answers TLS first; typo'd port in the outbound config.","solutions":["Verify the outbound address/port actually runs SOCKS5 (test with curl --socks5 host:port).","If the target is a different protocol, change the outbound protocolHandler accordingly (http, trojan, vless...).","If SOCKS4 is required instead, set the outbound to version 4 if supported or front it with a SOCKS5 server.","Check for captive portals / MITM middleboxes rewriting the first response bytes."],"exampleFix":"// xray config: pointing at an HTTPS port by mistake\n// before\n{ \"protocol\": \"socks\", \"settings\": { \"servers\": [ { \"address\": \"1.2.3.4\", \"port\": 443 } ] } }\n\n// after (SOCKS5 actually listens on 1080)\n{ \"protocol\": \"socks\", \"settings\": { \"servers\": [ { \"address\": \"1.2.3.4\", \"port\": 1080 } ] } }","handlingStrategy":"validation","validationCode":"// smoke-test the endpoint before wiring it as a socks outbound\nconn, err := net.DialTimeout(\"tcp\", addr, 3*time.Second)\nif err != nil { return err }\nconn.Write([]byte{0x05, 0x01, 0x00})\nreply := make([]byte, 2)\nio.ReadFull(conn, reply)\nif reply[0] != 0x05 { return fmt.Errorf(\"not a SOCKS5 server (version %d)\", reply[0]) }","typeGuard":null,"tryCatchPattern":"if err := client.Process(ctx, link, dialer); err != nil {\n\tif strings.Contains(err.Error(), \"unexpected server version\") {\n\t\t// endpoint is not SOCKS5; fix outbound address/port or protocol\n\t}\n}","preventionTips":["Prefer service discovery/config validation that probes the handshake before commit.","Double-check outbound protocol vs the actual service on the target port.","Avoid reusing ports across protocols behind the same address."],"tags":["socks","socks5","client","handshake","version-mismatch"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}