Install Memcached on a dedicated Ubuntu host, bind it to that host’s private address, allow TCP port 11211 only from your application servers, and verify a real set/get operation before connecting your application. Memcached is an in-memory, disposable cache: installing the daemon does not cache anything until application code uses a compatible client library.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What a separate Memcached server does
A separate cache host keeps frequently requested, reproducible data in RAM so application servers can avoid repeated database or service work. The cache is not a source of truth. Entries can disappear when the daemon restarts, the host is replaced, or memory pressure evicts items, so your database or other authoritative service must remain complete and recoverable.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteThe separate-host design also creates a network boundary. Every application request crosses that boundary, so latency, firewall rules, private routing, and failure behavior matter. Keep the cache and its clients on the same private network or security domain whenever possible. Never place an unauthenticated Memcached listener on an internet-facing interface.
Plan the host, address, and access policy
Choose a private Ubuntu host
Use a supported Ubuntu image with a private address reachable from every application server that will use the cache. Record the cache host’s private DNS name or address and the source subnet, or the individual application addresses, that must connect. A stable private name is easier to rotate than hard-coding an address, while the daemon itself still needs a local address to bind.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
- Reserve enough RAM for the operating system, Memcached, and monitoring in addition to the cache allocation.
- Place the host close to its clients in network terms; a remote region or high-latency link can erase the benefit of caching.
- Keep management access separate from the cache access rule, and apply your cloud security-group policy as well as the host firewall.
- Decide which application hosts may connect before opening port 11211.
- Use private DNS or a service-discovery name when possible so a replacement VM does not require application code changes.
- Document the cache host’s owner, maintenance window, expected clients, and what each client does when the cache is unavailable.
Understand the package defaults
The Ubuntu Memcached manual documents a 64 MB default memory limit, 1,024 simultaneous connections, four worker threads, and a 1 MiB maximum item size. These are daemon or package defaults, not recommendations for your workload. Set explicit values after measuring object sizes, request rates, connection counts, and available RAM. The default item limit also means that a large serialized object can fail even when the server still has free memory; enforce a smaller application-level limit where practical.
Install and enable Memcached
Ubuntu’s package keeps the daemon integrated with system updates and systemd. On the cache host, run:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →sudo apt update
sudo apt install memcached
sudo systemctl enable --now memcachedThe Memcached project also documents apt-get install memcached for Debian and Ubuntu; using the distribution package is preferable to maintaining an unrelated binary by hand. Confirm that systemd started the service:
sudo systemctl --no-pager --full status memcachedInstallation alone does not accelerate an application. The application must be configured with a Memcached client library and told which host and port to use. Installing the service does not discover keys, migrate database data, or add caching to existing requests automatically.
Configure memory, binding, and protocols
Ubuntu package settings are commonly stored in /etc/memcached.conf. Open the file with an editor:
sudoedit /etc/memcached.confSet a bounded memory allocation, the cache host’s private address, the standard TCP port, and no UDP unless you have a documented requirement for it:
Free tools Windows power users keep installed
One-click scans. No signup required.
-m 512
-l 10.20.0.15
-p 11211
-U 0Replace 10.20.0.15 with the cache host’s actual private address; do not copy that example literally. If the application and daemon run on the same machine, bind to 127.0.0.1 instead. The -l option selects the listening address, -m sets the memory limit in megabytes, -p selects the TCP port, and -U 0 disables UDP.
Size the cache deliberately
Do not equate the cache limit with total host memory. Leave headroom for Ubuntu, monitoring, connection buffers, and other services. Start with a measured estimate of the hot working set, then observe evictions and hit rate. Increasing the limit cannot recover data that the backing system has lost, and allocating too much can push the host into memory pressure.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Memcached stores items in RAM and evicts entries when it needs room, so a cache-size increase is not a durability feature. Treat a restart, replacement, or complete flush as an expected cold-cache event. Plan for a gradual refill from the authoritative database or service instead of trying to restore Memcached contents from backup.
Set connection and thread limits only when needed
The package defaults are often adequate for a first deployment. The -c option controls maximum simultaneous connections and -t controls worker threads. Raise them only when measured concurrency and CPU behavior justify the change; larger limits consume resources and do not fix a slow application or an undersized network path. The official defaults are 1,024 connections and four worker threads, but your package version and explicit configuration are what matter. Record every change so an incident responder can correlate it with latency or connection failures.
Keep the protocol surface explicit
Use TCP for ordinary client traffic and leave UDP disabled unless a specific, tested client requires it. If you change the TCP port with -p, update the firewall, security group, monitoring checks, and application configuration together. A port change that is made in only one layer commonly appears as a network outage.
Restrict TCP 11211 with a firewall
Allow inbound TCP 11211 only from the application subnet or named application hosts. Deny public ingress, and keep UDP closed when it is disabled in the daemon configuration.
sudo ufw allow from 10.20.0.0/24 to any port 11211 proto tcp
sudo ufw deny 11211/udp
sudo ufw status verboseAdapt 10.20.0.0/24 to the real source network. If only two application servers need access, separate host-specific rules are narrower than an entire subnet. Apply equivalent restrictions in your cloud firewall or security group; a host-level rule cannot compensate for a provider rule that permits the whole internet.
Check both directions of the path. The cache host needs an inbound rule, while the application host’s egress policy must permit the destination port. Network ACLs, routing tables, container policies, and service-mesh rules can all block a connection before UFW sees it. Keep administration ports and monitoring access in separate rules so a cache rule does not accidentally expose SSH or other services.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Why UDP should normally remain off
Memcached supports UDP, but an unnecessary UDP listener broadens the attack surface and can enable abuse of spoofable datagrams. Explicitly setting -U 0 and denying UDP 11211 makes the intended protocol surface clear. Turn UDP on only for a documented, tested client requirement and then restrict it to the exact sources that need it.
Restart and inspect the effective configuration
After editing the file, restart the service and inspect both systemd and the socket:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
sudo systemctl restart memcached
sudo systemctl --no-pager --full status memcached
sudo ss -ltnp | grep 11211The ss output should show a TCP listener on the private address and port 11211. A listener on 0.0.0.0:11211 or an untrusted public address indicates that the bind setting needs correction before you proceed. If there is no listener, read the service status and logs for a malformed option, an address that is not assigned to the host, or a port already in use.
Memcached’s text protocol can report the daemon’s effective settings. Run this from the cache host, or replace localhost with the private cache address when testing from an allowed application host:
Recommended Free Tools
printf 'stats settingsrnquitrn' | nc 10.20.0.15 11211Review the returned memory limit, connection limit, TCP and UDP ports, worker threads, binding protocol, SASL state, and maximum item size. This check catches a common operational mistake: editing a file that the running service is not using or leaving an old process running with different options. Save a known-good output during deployment so later changes are easy to compare.
Test reachability and the text protocol
Test from an allowed application host
A local test proves only that the daemon works on its own host. Run the smoke test from an application server whose address is permitted by the firewall:
printf 'set researchcore 0 60 5rnhellornget researchcorernquitrn' | nc 10.20.0.15 11211A successful response contains STORED, followed by a VALUE response containing hello. The fields in the set command are the key, flags, expiration in seconds, and byte count. This is a connectivity and protocol smoke test, not a capacity, load, durability, or failover test. The key expires after 60 seconds, demonstrating that expiration is part of the item metadata rather than a database delete operation.
Use the cache host’s private DNS name in the same test after confirming name resolution. Testing both the name and the numeric address helps distinguish a DNS problem from a firewall or daemon problem. Remove the temporary key or allow it to expire; do not use production key names for a connectivity check.
Interpret common failures
- Connection refused: the service may be stopped, listening on another address or port, or blocked by a local policy.
- Connection timed out: check the application host’s route, cloud security group, UFW rule, and any network ACL between the hosts.
- No listener on the private address: verify the
-lvalue and restart Memcached. - The command connects but no value is stored: check the byte count and carriage-return/line-feed sequence; the text protocol requires the declared number of bytes.
- “CLIENT_ERROR” or “SERVER_ERROR”: inspect the command syntax, item-size limit, and daemon logs before changing limits.
- The numeric address works but the hostname fails: correct private DNS, search domains, or resolver policy before changing Memcached binding.
- Only some application hosts work: compare their source addresses with the firewall and cloud security-group rules; a subnet rule may not match a changed interface.
Choose a client protocol deliberately
The text protocol is useful for a shell smoke test and is widely supported by client libraries. Memcached documentation recommends the newer meta protocol for new clients, while the binary protocol is deprecated. Follow the maintained library’s guidance rather than hand-building protocol frames in application code. Whatever protocol you choose, verify that the library supports your timeout, authentication, and failure-handling requirements.
Connect your application
Install a maintained Memcached client library for your application’s language and configure the private cache hostname or address with port 11211. Use the client’s connection pooling, timeout, and failure settings rather than opening a new socket for every request. Keep the cache endpoint in configuration or service discovery, not scattered through source code, so it can be rotated without a broad redeploy.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Keep cache behavior safe
- Use short, explicit expiration times for data that becomes stale.
- Handle cache misses by reading the authoritative database or service and repopulating the key.
- Expect connection errors, evictions, and restarts; they are normal cache conditions, not data-loss events for the source system.
- Keep keys bounded and namespaced so separate applications cannot overwrite one another accidentally.
- Enforce an application-level maximum object size that is below the daemon’s item-size limit, and compress only when CPU and latency measurements support it.
- Set finite connection and operation timeouts so an unavailable cache does not stall request workers indefinitely.
- Decide whether stale data is acceptable for each key and document the fallback behavior for a miss or timeout.
- Roll out the remote cache gradually, watching error rates and latency before making it the default path.
Memcached does not transparently accelerate arbitrary traffic. Every read, write, invalidation rule, serialization format, and fallback path must be implemented by application code. A successful network smoke test therefore proves only that a client can reach the daemon; it does not prove that the application is using the cache correctly.
Decide whether SASL authentication is appropriate
SASL is optional and works only when the server is built with SASL support and the client supports a compatible mechanism. It can authenticate clients, but it does not provide end-to-end encryption. The Memcached documentation explicitly notes that “SASL is not implemented as end-to-end encryption.”
If cache traffic could cross an untrusted network, keep Memcached on a private network and place an encrypted transport boundary around it, or use an architecture that provides transport encryption. Do not treat a username and password as a substitute for firewalling and private routing. After enabling SASL, verify the effective SASL state with stats settings and test with the same client library and mechanism your application will use. Confirm how credentials are provisioned and rotated; a password in a client configuration does not protect traffic that can be observed in transit.
Choose the deployment model that fits your workload
| Model | Network distance and latency | Failure isolation | Operations and access control | Recovery behavior |
|---|---|---|---|---|
| Local Memcached on each application host | Lowest network overhead; each process talks to a local listener. | A host failure removes only that host’s cache. | You patch and monitor many daemons; access is easy to keep on loopback. | Each host repopulates independently after restart. |
| Separate Ubuntu VM | One private network hop; measure latency and connection contention. | Application hosts can survive a cache-host failure, but all lose that cache at once. | You manage package updates, firewalling, memory, monitoring, and private access. | Restart or replacement invalidates the shared cache; applications must refill it. |
| Managed cache service | Depends on the provider’s placement and network path. | Provider options may reduce infrastructure failure impact, subject to the service design. | The provider handles much of the patching; you still configure identity, network rules, limits, and observability. | Read the service’s restart, eviction, backup, and replacement behavior; Memcached remains transient. |
In all three models, compare measured latency, memory limits, access controls, observability, patching responsibility, and what the application does when the cache disappears. A separate VM is not automatically more reliable than a local cache; it centralizes both capacity and a potential failure point. A managed service may reduce operating-system work, but it does not remove the need for private networking, source restrictions, client timeouts, or a backing data store.
Monitor the cache after launch
Track memory usage, evictions, item count, current and rejected connections, hit and miss rates, command latency, and host CPU and network utilization. Alert on sustained evictions or connection failures rather than on a single miss. A rising miss rate can reflect expired keys, a deployment that changed key names, insufficient memory, or an application path that bypasses the cache.
Keep systemd status and daemon logs available during incidents. When changing memory, connection, thread, or item-size settings, record the reason and compare behavior before and after the change. Configuration that looks harmless on an idle host can become expensive under concurrency. Include the cache host and private address in inventory, and test replacement or restart procedures so the team knows how quickly applications refill the cache.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOperational checklist
- Ubuntu is supported and the cache host has a private, reachable address.
- The
memcachedpackage is installed and enabled with systemd. /etc/memcached.confsets an explicit, measured memory limit.-lbinds only to the private or loopback address required by clients.-p 11211is expected, and-U 0disables unneeded UDP.- Firewall and cloud security-group rules allow TCP 11211 only from application hosts.
ssandstats settingsconfirm the effective listener and limits.- A remote
set/gettest returnsSTOREDand the expected value. - The application uses a maintained client library with timeouts and a database fallback.
- Sensitive deployments have private routing and an encryption plan; SASL alone is not encryption.
- Monitoring covers evictions, misses, connection failures, latency, and host resource pressure.
- A restart or replacement runbook explains how clients continue and how the cache repopulates.
Bottom line
A safe separate Memcached server on Ubuntu is a deliberately private, firewall-restricted daemon with explicit resource limits and a tested application integration. Bind it to the cache host’s private address, disable UDP unless required, permit only known application sources on TCP 11211, inspect the running settings, and prove remote set/get behavior before relying on it. Keep authoritative data elsewhere and design every cache client to tolerate misses, evictions, and restarts.
Frequently Asked Questions
How do I install Memcached on a separate Ubuntu server?
Use a supported private Ubuntu host, run sudo apt update and sudo apt install memcached, then enable it with sudo systemctl enable --now memcached. Configure the private bind address and firewall before allowing application traffic.
What IP should Memcached listen on?
Bind with -l to the cache host’s private address reachable by application servers. Use 127.0.0.1 only when clients run on the same host. Do not bind an unauthenticated daemon to a public interface or 0.0.0.0.
How do I open port 11211 safely?
Allow inbound TCP 11211 only from the application subnet or named application hosts in both the cloud security group and host firewall. Keep UDP disabled with -U 0 and deny UDP 11211 unless a documented client requirement exists.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How can I test that an application server can reach the remote cache?
From an allowed application host, send a text-protocol set/get command through nc. The response should include STORED and a VALUE containing the test string. This confirms connectivity and protocol handling, not load capacity or failover.
Does installing Memcached automatically cache my application?
No. Install the daemon and then configure application code with a maintained Memcached client library, endpoint, timeouts, key format, expiration policy, and fallback to the authoritative database or service.
Should I enable SASL?
SASL is optional and requires server and client support for a compatible mechanism. It authenticates clients but does not encrypt traffic, so retain private routing and firewall restrictions and add an encrypted transport boundary when confidentiality is required.
What happens when the separate cache server restarts?
Its in-memory entries can disappear and the cache becomes cold. Applications must tolerate misses, read authoritative data, and repopulate keys. Memcached is transient; plan recovery around refill rather than cache backups.
Are the Ubuntu defaults suitable for production?
The documented defaults are 64 MB of memory, 1,024 simultaneous connections, four worker threads, and a 1 MiB maximum item size. Treat them as starting points only; measure workload, reserve host headroom, and set explicit limits.
The Bottom Line
Keep Memcached private, restrict TCP 11211 to known application sources, disable unnecessary UDP, verify the effective daemon settings, and test remote set/get behavior. Use a client library with timeouts and an authoritative-data fallback because the cache can be evicted or lost at any time.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
