# Memcached UDP Exposure Checks

- **URL:** https://hackindex.io/services/memcached/enumeration/memcached-udp-exposure-checks
- **Path:** Memcached > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/memcached/enumeration.md)
- **Published:** 2026-02-25
- **Updated:** 2026-02-25

UDP exposure is a security issue even when you do not plan to abuse it. Your goal is to confirm whether UDP is enabled and reachable, then report it with proof.

## Detecting memcached UDP exposure

```bash
nmap -sU -p ${PORT:-11211} $TARGET_IP
```

Interpretation:

- `open|filtered` is common on UDP. You still need an application-level probe to confirm responses.

## Application-level UDP probe

Use a short timeout and a low-noise payload. `version` is usually enough.

```bash
printf "version\r\n" | nc -u -nv -w 2 $TARGET_IP ${PORT:-11211}
```

If it responds, you will typically see a `VERSION ...` line.

## What to do with a positive hit

- Report UDP exposure as a high-risk misconfiguration.
- Confirm whether UDP is expected in this environment. Modern hardening often disables it.

Notes that affect interpretation:

- Many current packages ship with UDP off by default, but older builds and custom configs may still expose it.
- Even if UDP is off, document that you validated it.

## References

- [https://manpages.debian.org/testing/memcached/memcached.1.en.html](https://manpages.debian.org/testing/memcached/memcached.1.en.html) - memcached -U default and UDP port behavior in current packages.
- [https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/](https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/) - Memcrashed amplification attacks via memcached UDP.