Port 11211: Memcached

Memcached cache server. Exposed UDP memcached produced the largest amplification attacks on record (over 1 Tbps in 2018). Never expose it.

  • Free
  • No Sign-Up
  • Runs in Your Browser

Examples:

Ports

1 of 41

Port Lookup

Port 11211 at a glance

Port11211
ProtocolTCP/UDP
ServiceMemcached
Open to the Internet?No, keep it on a private network
See What Is Listeningss -lntup | grep ':11211 '
Test From Outsidenc -zv your-server 11211
Block with UFWufw deny 11211/tcp; ufw deny 11211/udp
Block with nftablesnft add rule inet filter input meta l4proto { tcp, udp } th dport 11211 drop

Memcached uses TCP/UDP port 11211. Memcached cache server.

Exposed UDP memcached produced the largest amplification attacks on record (over 1 Tbps in 2018). Never expose it.

If ss shows something listening on port 11211 on a public address, bind it to 127.0.0.1 or a private interface in the service's own configuration, and drop the port in the firewall as well.

Questions

What is port 11211 used for?
Memcached. Memcached cache server.
Is it safe to open port 11211?
No, keep it on a private network. Exposed UDP memcached produced the largest amplification attacks on record (over 1 Tbps in 2018). Never expose it.
How do I check if port 11211 is open?
On the server, ss -lntup | grep ':11211 ' shows what is listening. From another machine, nc -zv your-server 11211 shows whether the firewall lets it through.
How do I block port 11211?
With UFW: ufw deny 11211/tcp and ufw deny 11211/udp. With nftables, add a drop rule for dport 11211 in your input chain.

Abuse from open ports on your VMs?

Frabs spots amplification, scans and floods leaving any VM and stops them, without touching your firewall.