Port 11211 Memcached – Free, Online, Private

What listens on 11211

Port 11211 is Memcached. The IANA name is memcache, Memory cache service, assigned in 2009, for TCP and UDP. Clients send short text or binary commands. get and set ride on TCP in almost every application. UDP exists for some clients and for stats, and it is the transport that made public memcached servers into amplification sources. There is no TLS in the classic protocol and no username. A newer proxy or a SASL build can add them. Redis is 6379 and is a different protocol. Pointing a Memcached client at Redis does not work, even though both are caches.

The IANA service name is memcache: Memory cache service. The practical transport is TCP and UDP. The checks below include both TCP and UDP, because both transports matter for this service. A process can bind this port without being the service in the registry. The commands show who bound it. They do not prove the protocol on the wire is the one IANA named.

Service notes for port 11211

Service notes for port 11211: the IANA name is memcache (Memory cache service), and the program people mean is Memcached. Port 11211 is the IANA memcache port, the memory cache service, on TCP and UDP. Memcached has no authentication in the classic protocol. Do not publish 11211. The classic server will answer anyone who can reach it, and a UDP listener on the internet will be used for reflection. Bind it to localhost or to the application subnet, disable UDP if you do not need it, and firewall TCP to the app tier. SASL is optional and often absent. Assume the cache is a shared bucket of untrusted bytes, not a secret store. Do not put sessions you cannot afford to lose, or tokens you cannot afford to leak, in a cache that any co-tenant process can read. Nothing in that paragraph applies to a different number just because the software family is similar. If your listener is not on 11211, you are on the wrong page.

A security group allows TCP and the app still errors because it was compiled against the UDP client, or the reverse. Match the client. Another trap is a listener on 127.0.0.1 inside a container and a publish that was forgotten, so the app on another container cannot connect. Another is a max item size. The port is fine and a set of a large value fails. Another is confusing a flush from one app with a firewall flap. The keys disappear and the socket stays up. Another is IPv6. :: is a second bind.

How to check whether it is open

On the machine itself, ask the kernel which socket is bound. ss and lsof do that. A firewall, a security group, and a Docker publish rule sit in front of that socket, so a listener is not the same thing as a port the internet can use. From somewhere else, nc -vz host 11211 tries a TCP handshake when the command is the TCP form. A refusal means something answered with a reset. A timeout means a filter dropped the packet or the host is unreachable. Those are different faults. memcached should own the TCP port, and it should not own a public UDP socket. A stats command from the app host is the protocol test. nc can send stats. It should not be able to do that from the internet.

grep and findstr match text. A pattern of :80 also matches :8080 and :8000. The lsof and Get-NetTCPConnection forms take a numeric port and do not have that substring bug. Use them when the number is ambiguous. ss filters in the kernel with sport = :N, which is also exact. On macOS, netstat -p selects a protocol. It does not print the process the way Linux netstat -p does. lsof prints the process.

• There is no authentication in the classic protocol. The network is the access list.
• UDP 11211 is an amplification source if it is public.
• Redis is 6379. The protocols are not the same.
• A flush empties the cache without closing the port.

Linuxsudo ss -lptn 'sport = :11211'
sudo lsof -nP -iTCP:11211 -sTCP:LISTEN
sudo ss -lpun 'sport = :11211'
sudo lsof -nP -iUDP:11211

macOSsudo lsof -nP -iTCP:11211 -sTCP:LISTEN
netstat -anv -p tcp | grep '\.11211[^0-9]'
sudo lsof -nP -iUDP:11211
netstat -anv -p udp | grep '\.11211[^0-9]'

Windowsnetstat -ano | findstr :11211
Get-NetTCPConnection -LocalPort 11211
Get-NetUDPEndpoint -LocalPort 11211

Remotenc -vz host 11211
nc -vzu host 11211