Port 11211 (memcached)

memcached in-memory cache.

Registered (user) port, 1024-49151 TCPUDP Caches Do not expose to the internet

What port 11211 is used for

memcached in-memory cache.

Security: should port 11211 be open?

Do not expose to the internet. Never expose, especially UDP. In 2018 open memcached servers were used for record amplification DDoS (around 50,000x, 1.7 Tbps). memcached 1.5.6+ disables UDP by default; bind to localhost or a private network and firewall it.

IANA assignment

Service nameProtoDescriptionAssigneeReference

memcache TCP Memory cache service Trond Norbye -

memcache UDP Memory cache service Trond Norbye -

Registry dates for this port: registered 2009-02-09.

Check what is listening on port 11211

Linux: is anything listening on TCP 11211?

sudo ss -tlnp 'sport = :11211'

Linux: UDP 11211

sudo ss -ulnp 'sport = :11211'

Linux / macOS: which process owns the port

sudo lsof -nP -i :11211

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':11211 '

Windows (Command Prompt)

netstat -ano | findstr :11211

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 11211 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 11211

From Windows

Test-NetConnection HOST -Port 11211

UDP probe (no reply does not prove it is closed)

nc -vzu -w 5 HOST 11211

Block port 11211 in the firewall

ufw

sudo ufw deny 11211/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 11211 -j DROP

nftables

sudo nft add rule inet filter input tcp dport 11211 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block TCP 11211' -Direction Inbound -Protocol TCP -LocalPort 11211 -Action Block

ufw

sudo ufw deny 11211/udp