What Is a Memcached DDoS Attack?

What is a Memcached DDoS attack?

A Memcached DDoS attack is a reflection and amplification attack. Attackers send small UDP requests with a forged source address, the victim's, to Memcached servers that are reachable from the internet. Those servers answer the victim with far larger responses. The victim is flooded by traffic it never asked for, while the real senders stay hidden behind the reflectors.

How it works

1. Memcached is an in-memory cache that applications use to keep frequently read data close at hand. It is meant to sit on a private network.
2. Some servers were left exposed to the internet with UDP enabled on port 11211 and no authentication.
3. UDP does not verify the sender, so an attacker can forge the source address. The server replies to that address.
4. A small request can trigger a very large response, so the traffic that reaches the victim is a multiple of what the attacker sent. The US-CERT bandwidth amplification table lists Memcached at 10,000 to 51,000 times, the highest on its list.

Real example

On 28 February 2018 GitHub was hit by an attack that peaked at 1.35 Tbps (126.9 million packets per second) and was reported as amplified by a factor of up to 51,000. In its incident report, GitHub says the site was fully unavailable from 17:21 to 17:26 UTC and intermittently unavailable until 17:30 UTC, after which it moved traffic to Akamai's edge network and filtered at its border. The Memcached project had released version 1.5.6 the day before, on 27 February 2018, which turned UDP off by default.

How to defend

These steps are for your own servers and network.

• Do not expose Memcached to the internet. Bind it to localhost or a private interface and block port 11211 at the firewall or security group.
• Disable UDP unless you need it (Memcached 1.5.6 and later have it off by default).
• Use SASL authentication or keep the cache reachable only through your application tier.
• Service providers: filter spoofed traffic at the edge. Ingress filtering (BCP 38) stops forged source addresses leaving the network, which removes the precondition for reflection.
• Victims: use upstream protection. A 1 Tbps flood cannot be absorbed by a single server or link. Use a DDoS-protection or CDN provider, and keep your ISP's emergency contact ready. CISA also suggests remotely triggered blackholing with upstream providers.

The general playbook is in how to stop DDoS attacks and DoS protection.

Common mistakes

• Assuming a cache is "internal" and never checking which ports face the internet.
• Relying on a default configuration from an older version that had UDP on.
• Believing your own firewall can absorb a volumetric flood. By the time packets reach it, the uplink is already full.
• Not noticing your server is the reflector. Unusual outbound UDP traffic from a cache host is a warning sign.

Related attacks

Memcached abuse follows the same pattern as the DNS amplification attack, and is one of the volumetric attacks described under distributed denial of service. Plain UDP floods send the traffic directly instead of reflecting it.

Where LoadFocus fits

LoadFocus never simulates attacks, and it does not reproduce Memcached amplification: that attack is reflected UDP traffic that only your network or DDoS-protection provider can absorb. LoadFocus load tests send HTTP and HTTPS traffic to systems you are authorised to test, and show how much legitimate load your application handles. For the difference between load and stress testing, see load testing vs stress testing.

FAQ: Memcached DDoS attacks

What port does a Memcached DDoS attack use?

UDP port 11211, the default Memcached port. Blocking it from the internet closes the main route.

Is my website at risk if I use Memcached?

You are at risk of being used as a reflector if Memcached is reachable from the internet with UDP on. You are at risk of being a victim in the same way as any other site. Binding the cache to a private interface fixes the first problem.

How big can these attacks get?

GitHub measured 1.35 Tbps on 28 February 2018, and the amplification factor was reported at up to 51,000. Attack sizes change over time, so treat any figure as a snapshot.

Did the 2018 fix end the problem?

Version 1.5.6 disabled UDP by default, which helps new installations. Old versions and servers that enable UDP explicitly can still be abused, which is why firewall rules still matter.

Can I test my defenses with LoadFocus?

No. LoadFocus does not generate attack traffic. It tests how your application behaves under legitimate HTTP load. DDoS resilience testing needs your protection provider's own process and written authorisation.