All DDoS Definitions
DDoS Testing Definition

Memcached Amplification

A memcached amplification attack is a Layer 3 reflection attack vector, one of the volumetric classes a thorough DDoS test is built to exercise. It abuses memcached servers exposed to the internet on UDP port 11211. The attacker stores a large value, then sends a small spoofed retrieval request carrying the victim's IP, and the server floods the victim with the cached payload. Memcached produces the highest known amplification factor, capable of multiplying attack bandwidth by tens of thousands of times.

Memcached amplification: store big, retrieve with a tiny query Attacker targets UDP 11211 left open to the internet 1. store a large value 2. small spoofed GET src = victim Exposed memcached returns the cached payload to the source cached payload flood up to tens of thousands of times larger Victim link overwhelmed from a tiny request Highest known amplification factor of any reflector the 2018 record floods reached 1.3 Tbps; closing UDP 11211 is the fix A test confirms whether upstream scrubbing absorbs the volume before the origin degrades, and how fast mitigation cuts over. BlackNeuron™
Memcached amplification: storing a large value then a small spoofed retrieval floods the victim with the cached payload

Why it matters in DDoS testing

The 2018 record-setting floods that hit 1.3 Tbps were memcached reflection, which made closing UDP 11211 to the public internet a standard hardening step. A test characterizes whether upstream scrubbing absorbs the volume before the origin degrades and how fast mitigation cuts over. Because the root cause is exposed services plus missing source-address validation (BCP 38), testing focuses on absorption capacity. The reflection family is covered in Understanding DDoS Attack Vectors.