memcached

Overview ¶

Package memcached decodes Memcached binary-protocol messages per the Memcached binary protocol specification. Runs on TCP/11211 (default). Compatible with Memcached, Amazon ElastiCache (Memcached-compatible), Google Cloud Memorystore (Memcached- compatible), and Couchbase (Memcached-compatible binary protocol on the data port).

Operationally, Memcached is a **high-value cache target** — caches session tokens, user data, API responses, and application state. Default Memcached ships with NO authentication and binds to all interfaces. Shodan finds tens of thousands of exposed Memcached instances on TCP/11211. Memcached has been weaponised for massive DDoS reflection/ amplification attacks (CVE-2018-1000115, 51000x amplification factor via UDP).

The wire format leaks:

• **Key names in cleartext** — every GET/SET/DELETE/INCR/ DECR/APPEND/PREPEND carries the cache key in cleartext. Key names often encode application structure (e.g. "session:abc123", "user:42:profile", "api:rate:10.0.0.1").

• **Cached values in cleartext** — SET/ADD/REPLACE carry the value payload in cleartext. Often serialised user sessions, API tokens, or application objects.

• **SASL authentication via 0x21 (SASL List Mechs) + 0x21 (SASL Auth) + 0x22 (SASL Step)** — when SASL is configured (Couchbase, ElastiCache with auth). SASL PLAIN = cleartext \0<username>\0<password>. The decoder surfaces auth_bytes LENGTH only (privacy-preserving).

• **Stats command exposure** — the STAT opcode (0x10) returns detailed server metadata: PID, version, uptime, total connections, evictions, memory usage — canonical version fingerprint + resource profiling.

Wrap-vs-native judgement

Native. The Memcached binary protocol is publicly
documented. 24-byte fixed header: magic (1) + opcode (1) +
key_length (2 BE) + extras_length (1) + data_type (1) +
status/vbucket_id (2 BE) + total_body_length (4 BE) +
opaque (4 BE) + CAS (8 BE). No crypto at the parse layer.

What this package covers

• **24-byte header walker**: magic (0x80 request / 0x81 response) + opcode + key_length + extras_length + data_type + status (response) / vbucket_id (request) + total_body_length + opaque + CAS.

• **35-entry opcode name table**: Get (0x00) / Set (0x01) / Add (0x02) / Replace (0x03) / Delete (0x04) / Incr (0x05) / Decr (0x06) / Quit (0x07) / Flush (0x08) / GetQ (0x09) / Noop (0x0A) / Version (0x0B) / GetK (0x0C) / GetKQ (0x0D) / Append (0x0E) / Prepend (0x0F) / Stat (0x10) / SetQ (0x11) / AddQ (0x12) / ReplaceQ (0x13) / DeleteQ (0x14) / IncrQ (0x15) / DecrQ (0x16) / QuitQ (0x17) / FlushQ (0x18) / AppendQ (0x19) / PrependQ (0x1A) / Verbosity (0x1B) / Touch (0x1C) / GAT (0x1D) / GATQ (0x1E) / SASL ListMechs (0x20) / SASL Auth (0x21) / SASL Step (0x22).

• **Key extraction**: cache key from request/response body (key_length bytes after extras).

• **Value length computation**: total_body - key_length - extras_length.

• **Response status decoder**: 15-entry status table (0x00 No error through 0x86 Auth continue).

• **SET extras walker**: flags (4 BE) + expiration (4 BE) from the extras section.

• **INCR/DECR extras walker**: delta (8 BE) + initial (8 BE) + expiration (4 BE).

• **SASL detection**: flags SASL Auth (0x21) with auth_bytes length.

What this package does NOT cover (deliberately out of scope)

• **Memcached text protocol** — "get key\r\n" / "set key 0 3600 5\r\n" text format; this decoder handles the binary protocol only.
• **Value deserialization** — cached values may be serialized objects (JSON, msgpack, application-specific formats); the decoder surfaces value_length but does not interpret the payload.
• **UDP Memcached** — the binary protocol over UDP adds an 8-byte datagram header (request_id + seq_num + num_datagrams + reserved); not handled.
• **TLS** — Memcached 1.5.13+ supports TLS; handle TLS strip first.
• **Proxy protocol** — some load balancers prepend PROXY protocol headers.
• **Credential extraction** — auth_bytes LENGTH only for SASL; NEVER surfaces actual credentials or cached values.