Port 8388 – Shadowsocks

TCP

Port 8388 is the default Shadowsocks proxy port. Shadowsocks is a SOCKS5 proxy designed to circumvent internet censorship by encrypting traffic and disguising it as normal HTTPS. The protocol uses AEAD ciphers (ChaCha20-Poly1305, AES-256-GCM). Running Shadowsocks on port 8388 is easily detected – use port 443 for better obfuscation.

Port Number

8388

Protocol

TCP

Service

Shadowsocks Proxy

Range

IANA Registered (1024–49151)

Description

Shadowsocks on port 8388 provides encrypted proxy access designed to evade DPI (Deep Packet Inspection) censorship systems. Clients connect locally via SOCKS5, and traffic is encrypted and relayed through the Shadowsocks server to the open internet. The default port 8388 is easily flagged by censorship systems that block known circumvention tool ports. Production deployments should use port 443 with AEAD ciphers (aes-256-gcm or chacha20-ietf-poly1305) and enable the simple-obfs or v2ray-plugin for protocol obfuscation that makes traffic indistinguishable from TLS/WebSocket. Outline (by Jigsaw/Google) uses Shadowsocks under the hood with simplified deployment.

Security risks

1DPI detection on default port: China's Great Firewall (GFW) and similar systems actively probe port 8388 for Shadowsocks traffic patterns. Running on the default port is effectively broadcasting your circumvention intent. Move to port 443 with obfuscation plugins (v2ray-plugin, cloak) that disguise traffic as normal HTTPS/WebSocket.
2Active probing attacks: censorship systems send specially crafted packets to suspected Shadowsocks servers. If the server responds differently than a normal HTTPS server, it is flagged and blocked. Use AEAD ciphers (aes-256-gcm, chacha20-ietf-poly1305) which fail-closed – invalid probes get no distinguishing response.
3Replay attacks on deprecated ciphers: stream ciphers (aes-256-cfb, rc4-md5) are vulnerable to replay attacks where captured encrypted packets are resent to redirect traffic. Only use AEAD ciphers which include nonce-based authentication preventing replay.
4Password brute-force: Shadowsocks uses a pre-shared key derived from a password. Weak passwords can be brute-forced offline from captured traffic (the key derivation is simple HKDF). Use a long random password (32+ characters) – it's never typed manually.
5Server-side traffic analysis: even with encryption, traffic volume and timing patterns can correlate Shadowsocks sessions to specific website visits. Combine with TOR or use random padding plugins for higher-security scenarios.

Firewall guidance

Do NOT use port 8388 in countries with active internet censorship – it is a known circumvention port and will be blocked or monitored. Use port 443 with v2ray-plugin (WebSocket + TLS) or cloak plugin to make traffic indistinguishable from normal HTTPS. On the server: configure a real web server (Nginx) on port 443 that also serves the Shadowsocks WebSocket path – this way even active probing sees a legitimate website.

Diagnosis commands

Verify Shadowsocks server is listening

shell

ss -tnlp sport = :8388

Test proxy connectivity via local SOCKS5 endpoint (client side)

shell

curl --socks5 127.0.0.1:1080 http://ifconfig.me

Check Shadowsocks server version (ensure it supports AEAD ciphers)

shell

ssserver --version

Verify traffic is actually encrypted (should see no plaintext patterns)

shell

tcpdump -i eth0 port 8388 -c 5 -nn

Usage examples

Port 8388 – Shadowsocks

shell

ssserver -s 0.0.0.0 -p 8388 -k password -m aes-256-gcm
sslocal -s server -p 8388 -l 1080 -k password -m aes-256-gcm
curl --socks5 127.0.0.1:1080 http://ifconfig.me

Common services on this port

Shadowsocks-libevShadowsocks-rustOutline Server (Jigsaw/Google)Clash (multi-protocol client)sing-box

Related ports

443

HTTPS (recommended port for stealth)

1080

SOCKS5 local proxy (client side)

8388

Shadowsocks default (this port)

1194

OpenVPN (alternative circumvention)

History

Shadowsocks was created by a Chinese programmer named 'clowwindy' in 2012 as a lightweight SOCKS5 proxy to bypass the Great Firewall. The original Python implementation used port 8388 by default. In 2015, clowwindy was pressured by Chinese police to delete the GitHub repository and cease development. The community forked it into shadowsocks-libev (C) and shadowsocks-rust. Google's Jigsaw team adopted the protocol for their Outline VPN product (2018). AEAD ciphers became mandatory in 2017 after research demonstrated attacks on stream cipher variants.

FAQ

Why not just use a VPN instead of Shadowsocks?

VPN protocols (OpenVPN, WireGuard, IPSec) are easily detected and blocked by DPI systems – they have recognizable handshakes. Shadowsocks with obfuscation plugins (v2ray-plugin over WebSocket+TLS on port 443) is designed to look like normal HTTPS browsing traffic. The Great Firewall can block all known VPN protocols but struggles to block what looks like HTTPS to any website.

What is the v2ray-plugin and why use it?

v2ray-plugin wraps Shadowsocks traffic in a WebSocket connection over TLS on port 443. To network observers (including DPI), it looks like a standard HTTPS WebSocket connection (used by chat apps, trading platforms, etc.). Combined with a real website on the same port (Nginx serves HTML, proxies /ws path to Shadowsocks), even active probing sees a legitimate server. This is the current state-of-the-art for circumvention stealth.