When a client or child proxy sends requests to a ProxySG and it is configured for ICAP scanning such traffic, the ProxySG will send the protocol within the SOCKS tunnel for scanning. So in other words, if the client is sending HTTP over SOCKS, only the HTTP within it will get sent via ICAP to be scanned. The SOCKS protocol itself does not get sent for scanning since this protocol is only used for transporting the protocol within it to the proxy.