11211
Summary
- // if you see it open
- Memcached ships with no authentication and no transport encryption by default, so an internet-exposed instance permits unauthorized read/write of cached data and plaintext traffic sniffing. UDP 11211 is the 'Memcrashed' reflection/amplification DDoS vector reported Feb-Mar 2018, with amplification factors up to ~51,200x, used in record-setting attacks including a ~1.35 Tbps flood against GitHub in March 2018. Mitigation: bind to localhost/internal only, disable UDP when unused, and block inbound 11211 (tcp+udp) at the edge on internet-facing hosts.
- // analyst note
- A public-facing open 11211 is a misconfiguration and an amplification/data-exposure risk — investigate as an exposed memcached instance, not a normal service.
About port 11211/tcp.
Port 11211/tcp is registered with IANA under the service name memcache, described as "Memory cache service," with assignee and contact Trond Norbye and a registration date of 2009-02-09; the port is dual-registered on TCP and UDP with identical fields, and the IANA reference column is blank (no RFC is cited for this assignment). In practice the port belongs to Memcached, a distributed in-memory key-value cache used to keep frequently accessed objects, query results, and session data in RAM so web applications can avoid repeatedly hitting a database or upstream API — a role it filled at very large scale at operators such as Facebook, Wikipedia, and YouTube. For an analyst the security story dominates. Memcached historically ships with no authentication and no transport encryption, so an instance reachable from the internet on 11211 exposes cached data to unauthorized read/write and lets traffic be sniffed in plaintext. The UDP side of the same port is worse: it is the vector for the "Memcrashed" reflection/amplification DDoS wave reported in February–March 2018, in which small spoofed UDP requests to open memcached servers produced responses with amplification factors as high as roughly 51,200x and drove record-setting attacks including a ~1.35 Tbps flood against GitHub in March 2018. Early-March 2018 Shodan snapshots found on the order of 100,000 internet-reachable memcached instances answering on 11211 (a historical figure, not a current count). Standard hardening is to bind memcached to localhost or an internal interface, disable UDP where unused, and block inbound 11211 (both TCP and UDP) at the network edge on any internet-facing host. A responsive 11211 on a public address should therefore be treated as a misconfiguration and an amplification/exposure risk rather than an expected service.
- IANA assignment
memcache— "Memory cache service"; reference blank (no RFC cited in IANA registry); assignee/contact Trond Norbye; registration date 2009-02-09; dual-registered 11211/tcp + 11211/udp (identical rows) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- registered (1024–49151)
- Related ports
- other caching/datastore services (e.g., 6379 Redis)
Primary use
Memcached distributed in-memory key-value caching daemon (object/session cache to offload databases and APIs)
Common software
memcached daemon; historically deployed at very large scale (Facebook, Wikipedia, YouTube, Twitter/X)
Security implications
no default auth/encryption → internet-exposed instances allow unauthorized cache read/write and plaintext sniffing; UDP 11211 is the "Memcrashed" reflection/amplification DDoS vector (amplification up to ~51,200x; ~1.35 Tbps GitHub attack, March 2018)
Exposure snapshot
early-March 2018 Shodan scans found ~100,000 internet-reachable memcached instances on 11211 (historical, not current; no 2026 scan performed)
- Mitigation
- bind to localhost/internal interface only, disable UDP if unused, block inbound 11211 (tcp+udp) at the edge for internet-facing hosts [Confirmed] — senki.org; Cloudflare blog
- Analyst note
- A public-facing open 11211 is a misconfiguration and an amplification/data-exposure risk — investigate as an exposed memcached instance, not a normal service.
About port 11211/udp.
Port 11211/udp is registered with IANA under the service name memcache, described as "Memory cache service," with assignee and contact Trond Norbye and a registration date of 2009-02-09; the port is dual-registered on TCP and UDP with identical fields, and the IANA reference column is blank (no RFC is cited for this assignment). The port belongs to Memcached, a distributed in-memory key-value cache that keeps frequently accessed objects, query results, and session data in RAM so applications can avoid repeatedly hitting a database or upstream API. The distinction that matters on the UDP side is not caching but abuse: most production memcached client libraries speak TCP, so legitimate UDP 11211 traffic is comparatively rare, and the UDP listener is chiefly notable as the vector for "Memcrashed," the reflection/amplification DDoS technique publicly reported starting around February 27, 2018. An attacker spoofs the victim's source IP in a small UDP request to an open, internet-reachable memcached server, and the server sends a much larger reply to the spoofed address. Cloudflare reported observing memcached-reflection attacks against its own network peaking at roughly 260 Gbps of inbound UDP traffic in the days around February 27, 2018, with amplification factors as high as about 51,200x (a ~15-byte request yielding a response up to ~750 KB). A separate and larger event — a ~1.35 Tbps memcached-reflection flood against GitHub — was reported by Akamai and GitHub in early March 2018; that is a distinct data point with a different target and date, not the same figure as Cloudflare's 260 Gbps. Contemporary 2018 scans found on the order of 100,000 internet-reachable memcached instances answering on 11211 (a historical figure from that incident window, not a current count). The published fix specific to Memcrashed is to disable memcached's UDP support (it can be turned off while TCP is kept for legitimate clients), bind to localhost or an internal interface, and block inbound 11211/udp at the network edge on any internet-facing host. A responsive 11211/udp on a public address should be treated as an amplification and data-exposure risk rather than an expected service.
- IANA assignment
memcache— "Memory cache service"; reference blank (no RFC cited in IANA registry); assignee/contact Trond Norbye; registration date 2009-02-09; dual-registered 11211/tcp + 11211/udp (identical rows) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- registered (1024–49151) [Confirmed] — IANA registry
- Related ports
- 11211/tcp (dual-registered sibling); other caching/datastore services (e.g., 6379 Redis)
Primary use
Memcached distributed in-memory key-value caching daemon; on UDP the port is chiefly relevant as an abuse vector rather than normal client traffic (most client libraries use TCP)
Common software
memcached daemon (same software as the TCP sibling; no UDP-specific alternate software identified)
Security implications
UDP 11211 is the "Memcrashed" reflection/amplification DDoS vector (reported starting ~Feb 27, 2018); Cloudflare observed ~260 Gbps peak inbound against its own network with amplification up to ~51,200x (~15-byte request → ~750 KB reply); a distinct ~1.35 Tbps flood hit GitHub in early March 2018
Exposure snapshot
2018-era scans found ~100,000 internet-reachable memcached instances on 11211 (historical/dated, not current; no 2026 scan performed)
- Mitigation
- disable memcached UDP support (the Memcrashed-specific fix — UDP can be turned off while TCP is kept), bind to localhost/internal only, block inbound 11211/udp at the edge for internet-facing hosts [Confirmed] — knownhost.com; senki.org
- Analyst note
- A public-facing open 11211/udp is an amplification and data-exposure risk — investigate as an exposed/misconfigured memcached instance, not a normal service.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| memcache | TCP | Memory cache service | 0.00% |
| memcache | UDP | Memory cache service | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.