Port 11211 – Memcached

TCP/UDP

Port 11211 is the default Memcached port (both TCP and UDP). Like Redis, Memcached has no authentication or TLS by default. In 2018, Memcached servers with UDP port 11211 exposed to the internet were used in massive DDoS amplification attacks (1:51000 amplification ratio). Always bind to localhost and never expose port 11211.

Port Number

11211

Protocol

TCP/UDP

Service

Memcached In-Memory Cache

Range

IANA Registered (1024–49151)

Description

Memcached on port 11211 provides simple key-value caching with no persistence. UDP 11211 is particularly dangerous when exposed – Memcached UDP was used for the GitHub DDoS attack (1.35 Tbps, 2018) because of its massive amplification factor. Memcached 1.5.6+ supports SASL authentication on TCP. Production deployments must bind to 127.0.0.1 only and firewall all external access.

Security risks

1DDoS amplification (UDP): Memcached UDP responses can be 51,000x larger than the request. The 2018 GitHub attack (1.35 Tbps) used exposed Memcached UDP on port 11211. Disable UDP entirely: memcached -U 0 (or -U 0 in systemd unit). There is no legitimate reason for UDP Memcached in most deployments.
2No authentication (default): Memcached has no auth mechanism in the default build. Any host that reaches port 11211 reads and writes all cached data – session tokens, database query results, rendered pages. SASL support exists since 1.5.6 but is rarely enabled.
3Cache poisoning: an attacker who reaches port 11211 can SET arbitrary keys with arbitrary values. If your application trusts cache contents without validation, poisoned cache entries serve malicious data to users until TTL expires.
4Data theft: Memcached stores whatever your application caches – often including user sessions, API responses, and database rows. A 'stats items' + 'stats cachedump' command sequence enumerates and reads all cached data.

Firewall guidance

Bind Memcached to 127.0.0.1 exclusively: memcached -l 127.0.0.1. Disable UDP: memcached -U 0. Block port 11211 (both TCP and UDP) at the perimeter firewall unconditionally. If multiple application servers need shared cache, place Memcached on a private subnet with security groups allowing only those servers. Never use a public IP.

Diagnosis commands

Basic stats – version, connections, memory usage

shell

echo 'stats' | nc -q1 localhost 11211 | grep -E '(version|curr_connections|bytes)'

List slab classes with item counts (shows what is cached)

shell

echo 'stats items' | nc -q1 localhost 11211

Check if UDP 11211 is listening (should NOT be)

shell

ss -ulnp sport = :11211

Test if UDP Memcached is exposed (if it responds, you are vulnerable to DDoS amplification)

shell

nmap -sU -p 11211 target

Usage examples

Port 11211 – Memcached

shell

memcached -l 127.0.0.1 -p 11211
echo 'stats' | nc localhost 11211
echo 'set key 0 0 5
hello
' | nc localhost 11211

Common services on this port

MemcachedAmazon ElastiCache Memcachedmcrouter (Facebook proxy)twemproxy (nutcracker)

Related ports

6379

Redis (similar role, more features)

8080

Application (cache consumer)

History

Memcached was created by Brad Fitzpatrick for LiveJournal in 2003. Port 11211 was registered with IANA. It became the standard web caching layer (Facebook, Wikipedia, YouTube) before Redis emerged as an alternative with more data structures. The 2018 DDoS amplification attacks led to UDP being disabled by default in newer packages.

FAQ

Memcached vs Redis?

Memcached: simpler (key-value only), multi-threaded (uses all cores natively), slightly faster for pure caching. Redis: richer data structures (lists, sets, sorted sets, streams), persistence, Lua scripting, pub-sub. Use Memcached for simple page/query caching. Use Redis when you need data structures or persistence.

How do I check if my Memcached is vulnerable to DDoS amplification?

Run: nmap -sU -p 11211 your-public-ip. If it responds, you are exposed. Fix: memcached -U 0 (disable UDP), memcached -l 127.0.0.1 (bind localhost only), and firewall UDP 11211 at the perimeter.