Memcached is a caching software typically used in web servers. Many web servers like wikipedia, wordpress, flickr cache their data using Memcached software. Memcached server typically runs on port 11211. A client software (such as web server) can make get and set queries to memcached server. As clients can store sensitive information in Memcached, it is not advisable to connect Memcached servers to internet.

For my research, I would like to search the active memcached servers that are connected to internet. A simple search query on shodan.io would be "port:11211". As I only want "active" memcached servers, I want to list the servers which store more than 1000 items (cur_items > 1000). May I know how to query shodan?

2 Answers 2


Shodan sends the STATS command and that information can be seen in the Memcached banner and metadata:


You can use that information to see the number of stored items though we don't allow filtering by that information via the API/ website so you need to download the search results to process it locally.


To get information about the number items you could use the STATS command after connecting to a memcached instance. Shodan doesn't run commands against all the servers it scans, rather it makes simple connections and records the response.

You can't connect to random machines and start running commands, that's not legal. I mention this because the way you worded your question it sounds like you're attempting to enumerate memcached servers to use in reflected DDOS attacks.

  • I mailed to shodan support and they mentioned that such a query is not possible. I don't want to conduct any attack though. I want to mention the stats in my class project report. Commented Oct 30, 2018 at 17:20
  • Yeah, there's no legal way to collect this information without permission from every system owner you connect to and query.
    – Daisetsu
    Commented Oct 30, 2018 at 17:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .