What an FTP Server Can Log About a SOCKS-Proxied Client
Record a complete connection tuple and time when an FTP server sees a proxy exit rather than the original client.
An FTP server receiving a SOCKS-proxied TCP connection sees the peer that opened the proxy’s outgoing connection. The SOCKS negotiation occurred between the client and proxy; it is not an extra identification header delivered to FTP.
Record the peer IP and source port, destination address and port, transport protocol, and an accurate timestamp with a clear time basis. A shared exit address can represent many simultaneous clients, so the IP alone is a weak correlation key.
Matching the outgoing connection to an earlier client connection requires records from the intermediary and any relevant address translation. Those records may not exist or may no longer be available. A destination-side packet capture cannot reconstruct a missing mapping.
HTTP forwarding headers are a different mechanism and do not accompany ordinary FTP. Even in HTTP, a claimed original-client field needs a trusted provenance; arbitrary client-supplied text does not establish who operated a connection.