Mitigating memcached Amplification Attacks

Traducciones al Español
Estamos traduciendo nuestros guías y tutoriales al Español. Es posible que usted esté viendo una traducción generada automáticamente. Estamos trabajando con traductores profesionales para verificar las traducciones de nuestro sitio web. Este proyecto es un trabajo en curso.
Create a Linode account to try this guide with a $ credit.
This credit will be applied to any valid services used during your first  days.

What is Memcrashed?

Recently there has been a significant increase in large-scale UDP reflection and amplification attacks across the internet. These attacks were all using the memcached protocol and originating from port 11211. Attackers send ordinary-sized UDP packets from a spoofed IP address to a server running memcached. These requests elicit extremely large packet responses from memcached, which quickly congest the victim’s network and results in a Denial of Service (DoS) scenario.

The vulnerability of memcached to aiding in massive Denial of Service attacks was presented at the POC 2017 security conference in Seoul, South Korea, in a paper titled Deluge – How to generate 2TB/s reflection DDoS data flow via a family network. Dubbed Memcrashed by Cloudflare, these attacks are now being observed in the wild, reaching several hundred gigabits per second of inbound UDP memcached traffic.

What has Linode done to mitigate this attack?

  • Inbound and outbound UDP 11211 traffic is blocked at the edge of our network. This is only a temporary solution.

  • Your Linode can not send or receive UDP traffic on port 11211 from outside of Linode’s network. Linodes can still communicate with each other over Linode’s network using UDP 11211.

I’m running memcached. What do I do?

Memcached should not be exposed to the internet. There are a few basic steps you can take to secure your memcached instance.

  • If you require memcached to communicate over a private network:

    1. Bind memcached to a specific private IP address and port.

    2. Configure your Linode’s firewall accordingly. If you need help setting up a firewall, see our firewall guides for more information.

  • If you do not require memcached to communicate over any network connection, disable UDP for memcached and ensure it is only listening on localhost.


  1. Memcached is configured by default to listen for incoming connections from any IP address on RHEL-based distributions, on both TCP and UDP. Change this to only listen on localhost, and as an added precaution, disable UDP for memcached.

    Edit the OPTIONS line in the memcached config file:

    File: /etc/sysconfig/memcached
    OPTIONS="-l -U 0"
  2. Restart memcached. If your system uses systemd:

    sudo systemctl restart memcached

    If your system uses SysV:

    sudo service memcached restart

Debian and Ubuntu

  1. Memcached is configured to listen on localhost by default in Debian and Ubuntu. This configuration is not susceptible to the amplification exploit, but you should still verify you’re not running a vulnerable setup:

    grep /etc/memcached.conf

    That should return:


    As you can see, memcached is listening on the localhost IP address.

    You can also use ss or netstat to check your system’s listening UDP ports:

    sudo ss -apu
    sudo netstat -lpu

    Memcached should again show that it’s listening on localhost, or address, as shown below:

    root@localhost:~# ss -aup
    State      Recv-Q Send-Q Local Address:Port                 Peer Address:Port
    UNCONN     0      0                    *:*                     users:(("memcached",pid=5021,fd=30),("memcached",pid=5021,fd=29),("memcached",pid=5021,fd=28),("memcached",pid=5021,fd=27))
  2. Disable memcached’s use of UDP as an additional precaution:

    cat <<EOT >> /etc/memcached.conf
    # Disable UDP
    -U 0
  3. Restart memcached. If your system uses systemd:

    sudo systemctl restart memcached

    If your system uses SysV:

    sudo service memcached restart

This page was originally published on

Your Feedback Is Important

Let us know if this guide was helpful to you.

Join the conversation.
Read other comments or post your own below. Comments must be respectful, constructive, and relevant to the topic of the guide. Do not post external links or advertisements. Before posting, consider if your comment would be better addressed by contacting our Support team or asking on our Community Site.
The Disqus commenting system for Linode Docs requires the acceptance of Functional Cookies, which allow us to analyze site usage so we can measure and improve performance. To view and create comments for this article, please update your Cookie Preferences on this website and refresh this web page. Please note: You must have JavaScript enabled in your browser.