cloudflare/cloudflared · error

Unsupported command: %v

Error message

Unsupported command: %v

What it means

StandardRequestHandler.Handle dispatches on the SOCKS5 command byte; only connect, bind, and associate are implemented. Any other command byte produces this error (after a commandNotSupported reply is attempted). It means the client requested an operation this handler does not support.

Source

Thrown at socks/request_handler.go:47

		dialer:       dialer,
		accessPolicy: accessPolicy,
	}
}

// Handle processes and responds to socks5 commands
func (h *StandardRequestHandler) Handle(req *Request, conn io.ReadWriter) error {
	switch req.Command {
	case connectCommand:
		return h.handleConnect(conn, req)
	case bindCommand:
		return h.handleBind(conn, req)
	case associateCommand:
		return h.handleAssociate(conn, req)
	default:
		if err := sendReply(conn, commandNotSupported, nil); err != nil {
			return fmt.Errorf("Failed to send reply: %v", err)
		}
		return fmt.Errorf("Unsupported command: %v", req.Command)
	}
}

// handleConnect is used to handle a connect command
func (h *StandardRequestHandler) handleConnect(conn io.ReadWriter, req *Request) error {
	if h.accessPolicy != nil {
		if req.DestAddr.IP == nil {
			addr, err := net.ResolveIPAddr("ip", req.DestAddr.FQDN)
			if err != nil {
				_ = sendReply(conn, ruleFailure, req.DestAddr)
				return fmt.Errorf("unable to resolve host to confirm access")
			}

			req.DestAddr.IP = addr.IP
		}
		if allowed, rule := h.accessPolicy.Allowed(req.DestAddr.IP, req.DestAddr.Port); !allowed {
			_ = sendReply(conn, ruleFailure, req.DestAddr)
			if rule != nil {

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Fix the client to send a standard SOCKS5 command (1, 2, or 3)
2. If you need custom commands, implement your own RequestHandler wrapping StandardRequestHandler
3. Verify the client stream isn't desynchronized (check the earlier greeting/version bytes)
4. Update or replace client proxy libraries that emit non-standard command codes

Example fix

// client
request.Command = 0x07 // unsupported

// after
request.Command = connectCommand // 0x01

// client: send only standard SOCKS5 commands
if !isSupportedCommand(request.Command) {
    return fmt.Errorf("refusing to send nonstandard command %d", request.Command)
}

func isStandardCommand(b byte) bool { return b == 0x01 || b == 0x02 || b == 0x03 }

if err := handle(req); err != nil && strings.Contains(err.Error(), "Unsupported command") {
    log.Warn().Uint8("cmd", req.Command).Msg("nonstandard SOCKS5 command")
}

When it happens

Trigger: Handle (via Serve) receiving a request whose Command field is not one of the constants connectCommand, bindCommand, or associateCommand.

Common situations: Client using an unofficial/experimental SOCKS command; corrupted command byte from a desynchronized stream; clients targeting other SOCKS servers with vendor extensions.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• Failed to read auth methods: %v
• Failed to get command version: %v
• Unsupported command version: %v
• Failed to format address: %v
• Unrecognized address type

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/c69dce5f585ef23f. Report an issue: GitHub.