diff --git a/KNOWN_ISSUES.md b/KNOWN_ISSUES.md
index 762cf81..19b946c 100644
--- a/KNOWN_ISSUES.md
+++ b/KNOWN_ISSUES.md
@@ -102,7 +102,27 @@ When reporting, please include:
 
 ---
 
-## 8. Remaining Gaps (Low Priority)
+## 8. UDP Features Disabled Under `-proxy`
+
+**Symptom:** Tools that depend on UDP fail with `UDP disabled under -proxy; the underlying feature cannot be tunneled` when `-proxy` (or `ALL_PROXY`) is set.
+
+**Details:** SOCKS5 UDP ASSOCIATE is rarely implemented correctly by proxy servers and client libraries. Silently bypassing the proxy for UDP when `-proxy` is configured would leak the operator's real source IP. gopacket therefore refuses UDP when proxied and surfaces a clear error through `transport.ErrUDPUnderProxy`.
+
+**Affected features:**
+
+| Feature | Tool(s) | Workaround |
+|---------|---------|------------|
+| SQL Server Browser discovery (UDP 1434) | `mssqlinstance` | Specify the port directly with `-port 1433` on `mssqlclient`; skip auto-discovery |
+| DNS SRV lookup routed through the DC | `CheckLDAPStatus` | Pass `-dc-host <hostname>` to skip discovery |
+| DNS hostname resolution via the DC | `GetADComputers` | Pass the target as an IP, or `-dc-ip <ip>` |
+| Forest-FQDN DNS fallback | `raiseChild` | Pass `-parent-dc <ip>` explicitly |
+| Local source-IP discovery | `smbexec` | Set `-target-ip <ip>` manually |
+
+**Status:** By design. UDP tunneling over SOCKS5 is not a gopacket goal. If your workflow genuinely needs UDP over a proxy, use `proxychains` (which hooks libc at a lower level and can intercept UDP sockets) or a full VPN instead of `-proxy`.
+
+---
+
+## 9. Remaining Gaps (Low Priority)
 
 These Impacket features are not yet implemented due to infrastructure requirements:
 
diff --git a/README.md b/README.md
index 6743193..5ef624f 100644
--- a/README.md
+++ b/README.md
@@ -41,7 +41,11 @@ To uninstall:
 ./install.sh --uninstall
 ```
 
-## Proxychains Support
+## Proxy Support
+
+gopacket supports two independent proxying paths. They can also be chained.
+
+### proxychains (LD_PRELOAD)
 
 All gopacket tools work through proxychains. Go binaries normally bypass proxychains because Go's runtime handles DNS and networking internally, skipping the `LD_PRELOAD` hooks that proxychains relies on. gopacket works around this by linking against the system C library for network operations, allowing proxychains to intercept connections normally.
 
@@ -50,6 +54,19 @@ proxychains gopacket-secretsdump 'domain/user:password@target'
 proxychains gopacket-smbclient -k -no-pass 'domain/user@dc.domain.local'
 ```
 
+### Internal SOCKS5 proxy (`-proxy`)
+
+Every tool accepts `-proxy` to route outbound TCP through a SOCKS5 server without relying on `LD_PRELOAD`. Accepted schemes: `socks5` and `socks5h`. When `-proxy` is unset, the `ALL_PROXY` / `all_proxy` environment variables are consulted as a fallback.
+
+```bash
+gopacket-secretsdump -proxy socks5h://127.0.0.1:1080 'domain/user:password@target'
+ALL_PROXY=socks5h://127.0.0.1:1080 gopacket-smbclient 'domain/user:password@target'
+```
+
+UDP-dependent features are **disabled** under `-proxy` rather than silently leaking packets (SOCKS5 UDP ASSOCIATE is rarely supported by proxies, and bypassing the proxy for UDP would reveal the attacker's real source IP). Affected features and their workarounds are documented in [KNOWN_ISSUES.md #9](KNOWN_ISSUES.md).
+
+**Chaining:** `-proxy` is compatible with proxychains. The TCP connection to the SOCKS5 proxy itself still goes through libc `connect()`, so `proxychains → gopacket → -proxy → target` works for nested routing scenarios.
+
 ## Documentation
 
 See the [Library Developer Guide](https://github.com/mandiant/gopacket/wiki) for full API documentation, code examples, and architecture overview for building custom tools on top of gopacket's 24 protocol packages.
@@ -196,6 +213,7 @@ KRB5CCNAME=ticket.ccache gopacket-secretsdump -k -no-pass 'domain/user@target'
 | `-dc-ip IP` | IP address of the domain controller |
 | `-target-ip IP` | IP address of the target (when using hostname for Kerberos) |
 | `-port PORT` | Target port (defaults vary by tool) |
+| `-proxy URL` | Route outbound TCP through a SOCKS5 proxy (e.g. `socks5h://127.0.0.1:1080`). UDP features are disabled. |
 | `-debug` | Enable debug output |
 
 ### Quick Examples
@@ -218,6 +236,9 @@ sudo gopacket-ntlmrelayx -t smb://target -socks
 
 # LDAP relay for RBCD
 sudo gopacket-ntlmrelayx -t ldaps://dc01.corp.local --delegate-access
+
+# Route all outbound traffic through a SOCKS5 proxy
+gopacket-secretsdump -proxy socks5h://127.0.0.1:1080 'corp.local/admin:pass@dc01.corp.local'
 ```
 
 ## Library
@@ -357,7 +378,7 @@ new tooling stays private. Open-sourcing gopacket narrows that gap.
 - Kerberos authentication requires a valid ccache file (TGT or service ticket)
 - For Kerberos, use the FQDN hostname - not an IP address
 - If `KRB5CCNAME` is not set, tools will look for `<username>.ccache` in the current directory
-- All tools work through proxychains
+- All tools support both proxychains and an internal `-proxy` SOCKS5 flag (see Proxy Support)
 - This project is for authorized security testing and research purposes only
 
 ## License