CyberHunter
LinkedIn profile - Bastien Cordier Email: contact@bastiencordier.pro
// Databases & caches

Port 11211: Memcached

Memcached cache server.

11211

How Memcached works

Databases & caches
appRAMget user:42< 1 ms appRAMget user:42< 1 ms

The application reads and writes values kept in memory: answers come back in well under a millisecond. It travels in clear text: anyone on the path can read it.

Transport
TCP · UDP
Exposure risk
8/10 high if reachable from the Internet
Encryption
Clear textreadable on the network
IANA status
Assigned1 registered service
Range
Registered (1024-49151)
Category
Databases & caches
01 Security

Is port 11211 dangerous?

Common attacks and weaknesses

  • UDP amplification: one of the largest DDoS vectors (factor up to 50,000).
  • Unauthenticated read and write of cached data.

How to secure it

  • Disable UDP (-U 0) and bind to localhost.
  • Use SASL if remote access is needed.
02 Registry

IANA registry entries for port 11211

ServicePortTransportDescriptionReferenceUpdated
memcache 11211 TCP, UDP Memory cache service - 2009-02-09

// source: IANA service name and port number registry

03 Check it

Which program uses port 11211, and is it reachable?

Linux

sudo ss -ltnup 'sport = :11211'      # process listening on 11211
sudo lsof -nP -i :11211

macOS

sudo lsof -nP -i :11211

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 11211 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 11211
netstat -ano | findstr :11211

From another machine

nmap -p 11211 -sV <host>
sudo nmap -sU -p 11211 <host>
nc -zv <host> 11211

Block it in the firewall

sudo ufw deny 11211/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 11211" -Direction Inbound -LocalPort 11211 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 11211 used for?

Memcached cache server.

Is port 11211 TCP or UDP?

Port 11211 is registered for TCP and UDP.

Is it safe to open port 11211?

It is rated 8/10 (high) when exposed to the Internet. UDP amplification: one of the largest DDoS vectors (factor up to 50,000). Disable UDP (-U 0) and bind to localhost.

How do I check if port 11211 is open?

On Linux run "ss -ltnup 'sport = :11211'", on macOS "lsof -nP -i :11211", and on Windows "netstat -ano | findstr :11211" to see the local process. From another machine, "nmap -p 11211 <host>" shows whether it is reachable.

05 Related
:3306 MySQL / MariaDB tcp · udp · high risk :1433 Microsoft SQL Server tcp · udp · high risk :5432 PostgreSQL tcp · udp · high risk :6379 Redis tcp · critical risk :27017 MongoDB tcp · critical risk :9200 Elasticsearch tcp · udp · critical risk :1521 Oracle Database tcp · udp · high risk :5984 CouchDB tcp · udp · high risk

Latest vulnerability news

All news