What is a Memcached amplification attack?
It's a reflection-and-amplification DDoS attack that abuses Memcached servers exposed to the internet without authentication. The attacker sends small requests with the victim's spoofed IP to UDP port 11211; the Memcached server replies with a payload thousands of times larger aimed at the victim. It has one of the highest amplification factors ever observed (up to ~51,000x).
Why does it reach record volumes?
In 2018 this vector produced 1.3 Tbps (GitHub) and 1.7 Tbps attacks, records at the time. The mix of UDP without source verification and huge responses from cached data turns every poorly exposed Memcached server into a massive traffic multiplier.
How to prevent it?
Never expose Memcached to the internet: bind it to localhost or an internal network only, disable UDP if unused, firewall port 11211, and filter source spoofing on the network (BCP38). On the target side, an anti-DDoS service able to absorb volumetric traffic.
