UDP test for your proxy

What this UDP test checks

A UDP test shows whether the UDP traffic from your browser leaves through your proxy or around it. Most proxies carry TCP only, so UDP can slip out through your own connection while every page load looks proxied.

This test puts two addresses side by side. On the left is the address websites see over TCP. On the right is the address our server saw when your browser sent it UDP packets. If they match, your UDP follows your proxy.

Start the test with your proxy or browser profile active. It runs in your browser and on our server, and nothing is saved.

How to read the sign between the addresses

The sign in the middle of the tool compares the two addresses. Each state means this:

• Same as exit IP

  Our server received your UDP from your exit IP. UDP and TCP take the same route.

• Same network

  UDP came from a neighbouring address on the same carrier. Mobile networks share address pools between subscribers, so this is normal and sites see the same network.

• Different network

  UDP left from another network than your exit IP. Sites that run their own servers see that address, so this is a leak.

• Different IP

  UDP came from another address and we couldn't identify its network. Treat it as a warning and run the test again.

• Exit IP unknown

  UDP arrived, but your exit IP couldn't be read, so there was nothing to compare it with.

• No UDP address

  The right side shows a reason instead. TCP only means WebRTC fell back to TCP, so UDP had no path around your proxy. Nothing arrived, Nothing sent and Not tested mean a firewall, an extension or a browser setting stopped the packets, or WebRTC is off.

How UDP over SOCKS5 works

SOCKS5 carries UDP with a second command, UDP ASSOCIATE, defined in RFC 1928. You may also see it called SOCKS over UDP or SOCKS5 UDP. It takes five steps.

1. 1

   Your app opens a TCP connection

   It connects to the proxy and logs in, as for any SOCKS5 request. This connection stays open for as long as the UDP session lasts.

   TCP + login
2. 2

   It sends UDP ASSOCIATE

   The request asks the proxy to relay UDP datagrams and says which address the app will send them from.

   CMD 0x03
3. 3

   The proxy returns a relay address

   The reply holds an IP address and a UDP port on the proxy. That is where the app must send its datagrams.

   BND.ADDR BND.PORT
4. 4

   The app wraps each datagram

   Every packet gets a small header that names the real destination, then goes to the relay address.

   RSV FRAG ATYP DST.ADDR DST.PORT DATA
5. 5

   The proxy forwards, and the session ends with the TCP connection

   The proxy sends the payload to the destination from its own address and wraps the replies for the app. When the TCP connection closes, the relay stops.

   TCP closed = relay closed

Which apps send UDP

Anything that values speed over perfect delivery tends to use UDP. Run the test if you use any of these.

Online games

Game clients send movement and state over UDP. Without UDP in the proxy, that traffic skips it or fails.

Voice and video calls

Calling and meeting apps send audio and video over UDP to keep the delay low.

DNS

Most name lookups are single UDP packets to port 53. A lookup outside the proxy shows which resolver you use.

HTTP/3 and QUIC

Chrome, Edge and Firefox try HTTP/3 on sites that offer it, and it travels over UDP port 443.

WebRTC

Browsers use it for calls and peer connections, and any page can start it. For the full WebRTC check, run the proxy leak test.

HTTP/3 and QUIC test

The HTTP/3 tile under the sign is a QUIC test. Our server answers over HTTP/2 and HTTP/3 and reports which protocol each request used and which address it came from.

Browsers try HTTP/3 only when UDP can get out. Behind a TCP-only proxy, the browser either falls back to TCP or sends QUIC around the proxy from your own connection. The tile tells you which:

• Stays on TCP: HTTP/3 never connected, so nothing leaked.
• Same as TCP: QUIC and TCP arrived from the same address.
• Different network from TCP: HTTP/3 left outside the proxy, and sites that support it can see that address.

Chrome and Edge give a definite answer. Other browsers may stay on TCP without trying, and then the tile says the browser didn't try HTTP/3.

What this UDP test does differently

Many UDP tests check a proxy from their own server: you enter a host and port, and they report whether it relays a packet. That tells you the proxy works. It doesn't tell you what your browser does.

This test checks your real browser traffic. Your browser sends UDP to our server, and our server records which address the packets came from, instead of trusting what the browser reports. UDP and HTTP/3 are checked separately, and addresses are compared by network, so a sibling address on a mobile carrier isn't a false alarm. The UDP side runs through WebRTC, so if WebRTC is off the sign says Not tested.

Checking a proxy from the command line

curl can't test UDP over SOCKS5. It uses SOCKS5 for TCP only and never sends UDP ASSOCIATE, so a working curl call proves nothing about UDP. It does show the TCP address, which is the left side of this test:

curl --proxy "socks5h://USERNAME:PASSWORD@HOST:PORT" https://www.cloudflare.com/cdn-cgi/trace

To test the UDP relay itself, you need a client that sends UDP ASSOCIATE, such as a short script or a tunnel like tun2socks, and a UDP service to talk to, for example a DNS query to a public resolver.

For HTTP/3 in a browser, open DevTools, go to the Network tab and add the Protocol column. h3 means HTTP/3.

What to do when UDP goes around your proxy

Use a proxy that carries UDP

ProxyStream Advanced servers carry UDP over SOCKS5, so UDP apps and HTTP/3 can run through the proxy. Standard servers carry TCP. See how our SOCKS5 proxies handle UDP and HTTP/3.

Turn off QUIC

Start Chrome or Edge with the --disable-quic flag, or set network.http.http3.enable to false in Firefox's about:config. The browser then stays on TCP.

Control WebRTC

Set the browser or profile to send WebRTC only through the proxy. The proxy leak test checks WebRTC in full.

UDP test questions

Other free tests

• Proxy leak testWebRTC, UDP, IPv6 and timezone checked against your exit IP.
• IP checkYour IP address, network and location, and every other address your browser shows.
• Proxy connection checkSix checks on your connection in one run, from exit IP to latency.