Plain definitions of 44 proxy and networking terms, from residential and datacenter proxies to sessions, protocols, IPv6 and proxy errors. Search for a term or jump to a category; most terms link to a fuller guide.
Or jump to a category
A proxy server is an intermediary server that forwards requests and responses between a client and a target server, so the two never connect directly. It can operate as a forward proxy, sitting in front of clients to relay their outbound requests, or as a reverse proxy, sitting in front of origin servers to receive requests on their behalf. Common uses include access control, caching, traffic filtering, and presenting a different source IP address to the target.
A forward proxy is a server that sits in front of one or more clients and relays their outbound requests to target servers on the internet. The target sees the proxy's IP address as the source rather than the client's own address, which is the main difference from a reverse proxy that fronts origin servers. Organizations deploy forward proxies for access control, caching, content filtering, and request logging.
A reverse proxy is a server that sits in front of one or more origin servers and answers client requests on their behalf. It handles tasks such as load balancing, TLS termination, caching, and request filtering, so clients never connect to the origin directly. Nginx, HAProxy, and Cloudflare are common examples.
Proxy versus VPN describes two different ways to route traffic through an intermediary. A proxy works at the application layer and redirects traffic for a specific app or protocol, such as a browser or an HTTP/SOCKS5 client, often without encrypting it. A VPN works at the operating-system or network layer, building an encrypted tunnel that carries all of a device's traffic to the VPN server before it reaches the wider internet.
An exit IP is the address a target server sees as the origin of a request when traffic is routed through a proxy. It is the proxy's outward-facing egress address rather than the client's own IP, which is why the target attributes the connection to the proxy. In the Tor network the equivalent concept is the exit node, the relay that forwards traffic to its final destination.
A proxy pool is the set of IP addresses that a proxy service distributes requests across, often rotating between them so consecutive requests can leave from different exit IPs. Health checks remove unresponsive or flagged addresses from active rotation, and failover logic reroutes traffic to working addresses when one stops responding. The size and quality of the pool affect how reliably a workflow can reach public targets.
A residential proxy routes traffic through IP addresses that internet service providers assign to real home connections, so requests reach a target carrying ordinary consumer ISP details rather than datacenter ones. Because the exit IP is registered to a consumer ISP and geolocates to a real area, it suits geo-accurate public-data collection, localization testing, and ad verification. Residential pools are typically large, and an address can rotate on every request or stay fixed for a sticky session.
On ColdProxyCompare residential plans
A datacenter proxy uses IP addresses hosted in commercial datacenters or cloud providers rather than on consumer ISP lines. These IPs are fast and inexpensive because they sit on high-capacity network infrastructure, but the address blocks are registered to hosting autonomous systems, so targets can identify the traffic as non-residential by checking the originating ASN. They fit high-volume work where throughput and cost per request matter most, such as monitoring, QA, and public-data collection from sites that accept datacenter traffic.
On ColdProxyDatacenter IPv6 proxies
An ISP proxy, also called a static residential proxy, uses an IP address that is hosted in a datacenter but registered under an internet service provider in regional registry records. This pairing gives the address residential-looking WHOIS and ASN attribution while keeping the stability, throughput, and fixed assignment of datacenter hosting. The same IP can be held across sessions, unlike rotating residential pools that change the exit address frequently.
A mobile proxy routes requests through IP addresses that mobile carriers assign to cellular connections over 3G, 4G, or 5G networks. Carriers place many subscribers behind shared public addresses using carrier-grade NAT, so a single mobile IP can front large numbers of legitimate users. That shared, dynamic nature tends to give mobile IPs higher trust, since blocking one address would affect many real subscribers.
An IPv6 proxy presents an IPv6 address, a 128-bit address as defined in RFC 4291, as its exit, so it suits targets reachable over IPv6. The IPv6 address space is vast, so providers can hand out very large allocations, such as a /64 or larger block per customer. An IPv6-only exit cannot reach a site that accepts only IPv4. Some providers also reach specific CDN-fronted domains that publish no AAAA record, but this is not a general IPv4 fallback.
On ColdProxyCheck a site's IPv6 reach
A dedicated proxy assigns an IP address to a single customer at a time, so that customer alone controls the request patterns and reputation attached to it. A shared proxy puts several customers on the same IP concurrently, which lowers cost but introduces contention for bandwidth and means one user's behavior affects the address reputation that everyone on it inherits. The choice trades the predictability of a private IP against the lower price of pooled use.
Metered and unmetered are two ways proxy services bill for traffic. A metered plan charges by data volume, as a set number of gigabytes or a price per GB, so cost follows the traffic used; when a pack runs out, buyers top up or pay an overage rate. An unmetered plan has no per-GB charge: the price follows a speed tier, or the number of IPs or ports, for a fixed period, though some providers apply fair-use limits. Metered fits a small or predictable traffic budget; unmetered fits steady, high-volume transfer.
Transparent, anonymous, and elite are a classification of HTTP proxies by how much information they disclose about the connection. A transparent proxy passes the client's IP onward in headers such as X-Forwarded-For or Forwarded (RFC 7239) and usually adds a Via header; an anonymous proxy withholds the client IP but still sends headers that identify the request as proxied; an elite or high-anonymity proxy sends neither the client IP nor proxy-identifying headers. The labels describe header behavior at the HTTP layer only and do not make any user untraceable, since the proxy operator and network still see the connection.
A rotating proxy assigns a different exit IP address to outbound requests, either changing on every request or after a short time interval, by drawing addresses from a pool. The client sends traffic to one fixed endpoint while the proxy varies the address the target server actually sees. This model fits high-volume, read-only collection of public data, where many independent requests do not need to share a single source address.
A sticky session, also called a static session, holds the same exit IP address for a set duration so that a sequence of related requests all originate from one address. It is the opposite of per-request rotation and is used for multi-step flows such as logging in, navigating a cart, or paging through results that expect a consistent source IP. The client usually selects the session with an identifier in the proxy username, often alongside a duration setting; a new identifier normally maps to a new IP.
IP rotation is the mechanism of cycling the outbound IP address used for requests across a pool of available addresses, switching either on each request or on a timer. Spreading traffic over many addresses keeps requests from concentrating on a single source IP. The pool can hold residential, datacenter, or mobile addresses depending on the service, and the rotation policy controls how often the address changes.
Concurrency is the number of connections or requests a client has in flight at the same time, sometimes counted as threads or parallel workers. Raising concurrency increases throughput, but it also raises the request rate a target server observes, which can trip rate limits or queueing. For reference, browsers historically cap HTTP/1.1 connections at about six per hostname, while HTTP/2 multiplexes many streams over one connection.
An HTTP proxy is a forwarding server that reads and relays plain HTTP requests on behalf of a client, operating at the application layer. An HTTPS proxy handles encrypted traffic by opening a tunnel with the HTTP CONNECT method, then passing the TLS bytes through without decrypting them, so the proxy can relay HTTPS without seeing the request contents. The same proxy software often serves both modes, switching to CONNECT tunneling when the client requests an encrypted destination.
A SOCKS5 proxy is a server that implements SOCKS Protocol Version 5 (RFC 1928), a session-layer protocol that relays both TCP and UDP traffic without inspecting the application protocol carried inside. Because it works below the application layer, it can forward any protocol, not just HTTP, and it supports authentication methods such as username/password. SOCKS servers conventionally listen on TCP port 1080.
TCP, the Transmission Control Protocol, is a connection-oriented transport protocol that delivers a reliable, ordered stream of bytes between two endpoints. It establishes a connection with a three-way handshake and uses acknowledgments and retransmission to recover lost or reordered data. Protocols including HTTP, TLS, and SSH run on top of it; the current specification is RFC 9293.
UDP, the User Datagram Protocol, is a connectionless transport protocol that sends datagrams with no handshake and no guarantee of delivery, ordering, or duplicate protection. Its 8-byte header keeps overhead low, which suits latency-sensitive traffic such as DNS, QUIC, and real-time audio and video. The protocol is defined in RFC 768.
A port is a 16-bit number, ranging from 0 to 65535, that identifies a specific service endpoint on a host so that one IP address can run many services at once. A proxy port is the port a proxy server listens on for incoming client connections, for example the conventional 1080 for SOCKS or 8080 for an HTTP proxy. The client directs traffic to the proxy's IP address and that port, and the proxy forwards it onward.
SNI, Server Name Indication, is a TLS extension defined in RFC 6066 in which the client includes the target hostname in the ClientHello message at the start of the handshake. This lets a server or CDN that hosts many sites on one IP address select and present the correct certificate for the requested name. Because the ClientHello is sent before encryption is negotiated, the SNI value travels in cleartext unless Encrypted Client Hello (ECH) hides it.
IP whitelisting, also called IP authentication, is a method of authorizing proxy access by pre-approving one or more client source IP addresses instead of checking a username and password on each request. The client adds its public IP to an allowlist on the proxy provider's dashboard, and any request from that IP is accepted while requests from other addresses are refused. It removes the need to send credentials per request, which suits servers with a static IP, but it does not work well behind a dynamic or shared address that changes.
Username and password authentication is a credential-based method where the client proves it is authorized to use a proxy by supplying a username and password on each connection. For HTTP and HTTPS proxies, the credentials are sent in the Proxy-Authorization request header, typically as a Base64-encoded user:pass pair, after a 407 Proxy Authentication Required challenge (HTTP semantics, RFC 9110). For SOCKS5 proxies, the username/password method defined in RFC 1929 carries the same credentials during the connection handshake.
Proxy credentials are the connection details a client needs to reach and authenticate with a proxy, usually the host (or IP), the port, and a username and password. They are commonly written in two compact forms: host:port:user:pass, or user:pass@host:port embedded in a proxy URL such as http://user:pass@host:port. The username and password portions are omitted when the proxy uses IP whitelisting instead of credential-based authentication.
An IP address is a numeric label assigned to a device on a network so that traffic can be routed to and from it. It comes in two versions: IPv4, written as four dotted-decimal numbers like 203.0.113.5, and IPv6, written in hexadecimal groups. Addresses are either public, meaning routable across the internet, or private, used only inside a local network and not reachable directly from outside.
IPv4 is the fourth version of the Internet Protocol and uses 32-bit addresses, written in dotted-decimal notation such as 192.0.2.1. The 32-bit width allows about 4.3 billion unique addresses, a pool that has been exhausted at the registry level. Because of that scarcity, many devices share a single public IPv4 address through NAT and carrier-grade NAT rather than holding one of their own.
IPv6 is the most recent version of the Internet Protocol and uses 128-bit addresses written as eight groups of hexadecimal digits separated by colons, for example 2001:db8::1. The 128-bit format provides roughly 3.4 x 10^38 addresses, enough to give every device a unique public address and restore direct end-to-end addressing without NAT. Proxies that route through these addresses are called IPv6 proxies.
An ASN (Autonomous System Number) is a globally unique number that identifies an autonomous system, a network of one or more IP prefixes run by a single entity such as an ISP or hosting company under one routing policy. ASNs are exchanged in the Border Gateway Protocol (BGP) to advertise which networks each operator controls. They are assigned by the Regional Internet Registries, originally as 16-bit numbers and now also as 32-bit numbers, following the guidelines in RFC 1930.
A subnet is a smaller block carved out of a larger IP network so that addresses can be grouped and routed more efficiently. CIDR (Classless Inter-Domain Routing), defined in RFC 4632, expresses a network as a base address plus a prefix length after a slash, for example 192.0.2.0/24, where the prefix length is the number of leading bits that identify the network. A /24 covers 256 addresses, and each smaller prefix number doubles the size of the block.
DNS (Domain Name System) is the hierarchical naming system, defined in RFC 1034 and RFC 1035, that translates human-readable hostnames such as example.com into the IP addresses clients need to reach a server. A resolver queries authoritative name servers and follows the hierarchy from the root zone down to the requested domain. Most lookups travel over UDP or TCP port 53.
A public IP, also called an external IP, is the internet-routable address that websites and other servers see as the source of a connection. A public IPv4 address equals the router's WAN IP only when the router holds that address itself: behind carrier-grade NAT the router's WAN IP is often a shared address in 100.64.0.0/10 (RFC 6598), and behind a second router it is a private address. Devices on a local network usually share one public IPv4 address through NAT, while on IPv6 each device usually has its own public address; traffic sent through a proxy reaches the target from the proxy's exit IP instead.
CGNAT (Carrier-Grade NAT) is a technique that lets an ISP share one public IPv4 address among many subscribers by translating their traffic at the carrier's network rather than only at the home router. RFC 6598 reserved the 100.64.0.0/10 range as shared address space for the link between carrier NAT devices and customer equipment, keeping it separate from ordinary private ranges. CGNAT is a direct response to IPv4 scarcity and is why mobile and many broadband users appear to the internet under an address shared with other customers.
Geo-targeting is the practice of selecting proxy IP addresses by geographic location, such as country, region, city, or postal code, so that requests appear to originate from a chosen place. It works by mapping each proxy's exit IP to a location using IP geolocation data, then routing traffic through an IP that matches the target. Common uses include localization testing, ad and price verification, and checking local search engine results.
On ColdProxyBrowse proxy locations
ASN targeting is the selection of proxy IPs that belong to a specific Autonomous System Number, the globally unique identifier for the network or ISP that announces those IP ranges through BGP. An ASN was originally a 16-bit value and now also exists as a 32-bit number, and the registries (IANA and the regional internet registries) allocate them to network operators. It is used when a test depends on the originating network itself, for example checking how a service responds to traffic from a particular carrier or hosting provider rather than just a country.
City and ZIP targeting narrows geo-targeting below the country level to a specific city or postal code, selecting proxy IPs whose geolocation data resolves to that smaller area. It depends on having enough IP supply in the requested location, so availability and accuracy vary by market and can be sparse outside major metros. Postal-code precision relies on the granularity of the underlying IP geolocation database, which is generally less reliable than country-level mapping.
Latency is the round-trip time for a request to travel from a client to a target and for the response to return, usually measured in milliseconds. Because a proxy inserts an extra network hop between the client and the destination, it adds some latency, and the size of that increase depends on the proxy's location and the path to the target. It is separate from throughput: latency measures the delay of a single round trip, not how much data the link can carry.
Bandwidth is the maximum rate at which data can be transferred across a network connection, typically expressed in megabits per second (Mbps) or gigabits per second (Gbps). It describes capacity, or how much data the link can move in a given period, rather than how quickly a single request completes. Bandwidth and latency are independent: a connection can have high bandwidth and still show high latency if each round trip is slow.
Uptime is the proportion of time that a service is operational and reachable, stated as a percentage over a defined period. For example, 99.9% uptime over a year allows for roughly 8.8 hours of downtime, while 99.99% allows for about 53 minutes. The figure is meaningful only alongside the measurement window and what counts as an outage. Uptime differs from a success rate, which counts the share of connection attempts that work rather than the time a service is reachable.
These are HTTP status codes commonly seen when working through a proxy: 407 Proxy Authentication Required means the proxy needs valid credentials before it will forward the request, 403 Forbidden means the server understood the request but refuses to authorize it, and 429 Too Many Requests means the client has sent too many requests in a given window. 502 Bad Gateway means an upstream server returned an invalid response, and 504 Gateway Timeout means an upstream server did not respond in time. The 407, 403, 502, and 504 codes are defined in RFC 9110, and 429 is defined in RFC 6585.
Rate limiting is a control that caps how many requests a client, IP address, or account may make within a fixed time window, such as 100 requests per minute. When a client exceeds the limit, the server commonly responds with HTTP 429 Too Many Requests and may include a Retry-After header indicating how long to wait. Staying within published limits and pacing requests is part of compliant public-data collection.
CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart, a challenge-response test used to distinguish human visitors from automated clients. Common forms include distorted text, image-selection grids, and background risk scoring that runs without user interaction. Maintaining good IP reputation and sending requests at reasonable rates tends to reduce how often servers challenge legitimate automated workflows.
Need a different speed or traffic allowance? Contact us through the channels on our website so we can assess whether a custom plan is possible.
