# How a 1.4Tbps Memcached Amplification Attack Works — and How to Stop It > Memcached-based reflection attacks can amplify traffic by a factor of 51,000x. We break down exactly how attackers exploit these servers, why this is a network-layer problem, and where an L7 reverse proxy like Akarguard does and does not help. - Category: Attack Analysis - Author: Akarguard Team, Security Engineering - Published: Sep 13, 2026 - Canonical: https://akarguard.net/blog/memcached-amplification-attack --- In February 2018, GitHub was hit with 1.35Tbps of traffic — at the time, the largest DDoS attack ever recorded. The weapon: Memcached, an open-source caching system that tens of thousands of operators had accidentally exposed to the public internet. ## What Is a Memcached Amplification Attack? Memcached is designed to run inside trusted networks, not on the public internet. It listens on UDP port 11211 and responds to any query without authentication. Attackers exploit this by sending small requests with a spoofed source IP — the victim's address — to publicly exposed Memcached servers. Each server then floods the victim with a response that can be up to 51,000 times larger than the original request. > **Amplification factor** — A 15-byte request can trigger a 750KB response — a 51,000x amplification ratio. With thousands of vulnerable servers, attackers can generate terabit-scale floods from a laptop. ## Anatomy of the Attack - Attacker pre-loads a Memcached server with a large value (e.g., 1MB payload). - Attacker sends a UDP GET request to the server with the victim's IP as the source. - The Memcached server sends the full payload to the victim — no questions asked. - With 10,000 servers, the attacker can sustain 500Gbps+ from a single machine. ## How Akarguard Mitigates It It is worth being clear about scope: Memcached and other UDP reflection is a network-layer (L3/L4) attack. Akarguard is a reverse-proxy edge that protects HTTP/HTTPS applications at the point where your DNS sends traffic to it. It does not replace the upstream network filtering and BCP38 source-address validation that stop reflection before it saturates a link. - Web traffic is routed through the Akarguard reverse-proxy edge via a DNS change, which keeps your origin IP off the public record. - At the application layer the edge enforces per-IP rate and connection limits, WAF rules and challenge modes. - Volumetric UDP reflection is best stopped upstream at the network by your host or transit provider; ask whether they perform ingress source-address filtering (BCP38). - Detection runs continuously and every mitigation event generates an alert and a downloadable PDF report. ## What You Can Do Right Now If you run Memcached, disable UDP support immediately (--listen 127.0.0.1 or firewall port 11211/udp). Shodan currently indexes over 85,000 publicly exposed Memcached instances — each one is a potential weapon against any target on the internet. > Disabling UDP on Memcached costs you nothing. Leaving it enabled costs everyone. --- Source: Akarguard Security Blog (https://akarguard.net/blog). Akarguard provides DDoS protection: traffic is proxied through our edge, attack traffic is filtered, and clean traffic reaches your origin. Reuse of this article with attribution and a link to the canonical URL is permitted.