Updated: 30 September 2026 · Applies to: memcached 1.6 on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10, Ubuntu 24.04 and 26.04, Debian 13
In 2018, memcached servers that were open to the internet over UDP were used for record-breaking DDoS attacks: a small spoofed request made the server send a huge reply to the victim. Since then, memcached disables UDP by default, and the packages on current distributions listen only on the local machine. We checked the defaults on AlmaLinux 9 and 10 and Debian 13. This guide shows how to confirm that your server is safe.
1. Check where memcached listens
ss -lntup | grep 11211
A safe setup shows only 127.0.0.1:11211 (and [::1]:11211) over TCP, and no UDP line.
2. Check the configuration
On AlmaLinux, Rocky Linux and RHEL, /etc/sysconfig/memcached:
OPTIONS="-l 127.0.0.1,::1"
On Ubuntu and Debian, /etc/memcached.conf:
-l 127.0.0.1 -l ::1
Keep these defaults when only applications on the same server use memcached. UDP is off unless a -U port is set; to be explicit, add -U 0. Restart after changes: systemctl restart memcached.
3. If other servers must connect
- Listen on a private network address, not a public one:
-l 127.0.0.1,10.0.0.5. - Allow only the application servers in the firewall:
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/24" port port="11211" protocol="tcp" accept' firewall-cmd --reload
With UFW:ufw allow from 10.0.0.0/24 to any port 11211 proto tcp. - memcached has no password by default. For traffic that leaves a trusted network, add authentication (SASL,
-S) or TLS, or use a VPN between the servers.
4. Test from outside
From another machine, nc -zv SERVER-IP 11211 should fail (connection refused or timeout). Also check that nothing answers on UDP port 11211.
Memory size
The cache size is set with CACHESIZE (in megabytes) in /etc/sysconfig/memcached, or -m in /etc/memcached.conf. The default of 64 MB is small; size it for your application, but leave enough RAM for everything else.
Official documentation: memcached wiki.
