Port reference
Port 11211 (TCP/UDP) – Memcached
Default port for the Memcached distributed memory caching system.
Quick facts
- Transport
- tcp, udp
- Category
- Registered
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Older Memcached versions listened on all interfaces over both TCP and UDP with no authentication. Modern packages disable UDP and bind to localhost by default, but exposed instances persist.
What is port 11211 used for?
Port 11211 is the default for Memcached, a high-performance distributed memory caching system used to speed up dynamic web applications by caching query results, session data, and computed objects. Frameworks like Django, Rails, and WordPress (via plugins) commonly use it through client libraries. Applications talk to it over TCP, and older configurations also enabled a UDP interface on the same port.
When would you open it?
Open or forward 11211 when your web or application servers run on different machines from the Memcached server and need to reach the cache. Restrict it to those specific app hosts on a private network. If the cache runs on the same machine as the app, leave it on localhost.
Is it safe to open?
Memcached has no authentication by default and its UDP interface was famously abused for massive DDoS amplification, so it should never face the internet. Disable UDP, bind it to localhost or a private interface, and firewall it to trusted hosts. See the security notes below.
How to check if this port is open
ss -tulpn | grep :11211
nmap -p 11211 <target>netstat -ano | findstr :11211
Test-NetConnection <host> -Port 11211lsof -i :11211
nmap -p 11211 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 11211 to your device's local IP, internal port 11211, protocol TCP/UDP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 11211/tcpsudo firewall-cmd --permanent --add-port=11211/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 11211 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 11211" -Direction Inbound -Protocol TCP -LocalPort 11211 -Action AllowSecurity & risks
Common attacks
- UDP reflection/amplification DDoS (record ~50,000x amplification in 2018)
- Unauthenticated access to read or flush cached data
- Cache poisoning of application data
- Information disclosure of session tokens and secrets held in cache
Hardening
- Disable UDP (start with -U 0) unless explicitly required
- Bind to localhost or a private interface (-l 127.0.0.1)
- Never expose 11211 to the internet; firewall to trusted app hosts
- Enable SASL authentication and require TLS where supported
- Keep Memcached patched and rate-limit at the network edge
How to block this port
sudo ufw deny 11211/tcpsudo firewall-cmd --permanent --remove-port=11211/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 11211 -j DROPNew-NetFirewallRule -DisplayName "Block 11211" -Direction Inbound -Protocol TCP -LocalPort 11211 -Action Blocknmap snippet
nmap -p11211 --script memcached-info <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Why is Memcached used for DDoS amplification?
- Its UDP interface returns large responses to tiny spoofed requests, reaching ~50,000x amplification (CVE-2018-1000115). Disable UDP with -U 0 and never expose 11211 to the internet.
- Does Memcached have authentication?
- Plain Memcached has none by default, though SASL is available. Treat it as unauthenticated, bind it to localhost or a private network, and firewall the port.