Port 11211: Memcached

What uses port 11211

Memcached is a simple in-memory cache used by many PHP, Python and Ruby applications, and by Amazon ElastiCache for Memcached. It has no authentication in its default text protocol. Exposed Memcached servers with UDP enabled were behind the record 1.3 Tbps DDoS against GitHub in 2018, which is why UDP is now off by default.

Should port 11211 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

• Start memcached with -l 127.0.0.1 (or a private IP) and -U 0 to disable UDP if your version still enables it.

Check what is listening on port 11211

sudo ss -ltnp 'sport = :11211'
sudo ss -lunp 'sport = :11211'

sudo lsof -nP -iTCP:11211 -sTCP:LISTEN
sudo lsof -nP -iUDP:11211

Get-NetTCPConnection -LocalPort 11211 -State Listen
Get-NetUDPEndpoint -LocalPort 11211
netstat -ano | findstr :11211

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 11211

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:11211 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 11211 -State Listen).OwningProcess

Allow port 11211 from trusted networks only

The examples allow 11211 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 11211 proto tcp
sudo ufw allow from 10.0.0.0/8 to any port 11211 proto udp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 11211 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="11211" protocol="tcp" accept'
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="11211" protocol="udp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "Memcached 11211/TCP" -Direction Inbound -Protocol TCP -LocalPort 11211 -Action Allow -RemoteAddress 10.0.0.0/8
New-NetFirewallRule -DisplayName "Memcached 11211/UDP" -Direction Inbound -Protocol UDP -LocalPort 11211 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Port 11211 with Docker

# Publish on localhost only. Docker's port rules bypass ufw and firewalld,
# so -p 11211:11211 would expose the port to the whole network.
docker run -d -p 127.0.0.1:11211:11211 memcached

The format is -p host_port:container_port. Containers on the same Docker network reach each other on the container port directly, without publishing it. Convert a long docker run command into a Compose file with docker run to compose.

Test port 11211 from another machine

nc -zv example.com 11211

Test-NetConnection example.com -Port 11211

Related ports

• Port 6379 (Redis): the default port for Redis and Valkey.
• Port 3306 (MySQL / MariaDB): the default port for MySQL and MariaDB.

More databases ports

1433 (Microsoft SQL Server) , 1434 (SQL Server Browser) , 1521 (Oracle Database) , 5432 (PostgreSQL) , 8086 (InfluxDB) , 9042 (Cassandra / ScyllaDB) , 9200 (Elasticsearch / OpenSearch) , 9300 (Elasticsearch transport) . See all ports in the port lookup.

Sources

• IANA port registry: 11211

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions