MemReflect is another implementation on the Memcached killswitch. Unlike Memfixed, which uses an active mitigation model, this one uses a passive model. It sends back killswitch after receiving any UDP packet from 11211 port. This could mitigate the unknown vulnerable memcached servers. Note: Some server does not support shutdown command, so there's no way to prevent them from being used anyway. However by using flush_all, the amplify rate is limited.
The program automantically sets iptables and routing to receive UDP packets from 11211. TPROXY module and root permission is required.
-p The port memreflect listen on (Can be any port rather than 11211)
-s Use shutdown together with flush_all command
go get -t github.com/Max-Sum/memreflect/build
go build -o memreflect github.com/Max-Sum/memreflect/build
sudo ./memreflect -p 11211
The program would set iptables and routing automantically, but you need to give the capability of net_admin to the docker.
latest Contains program and source file
binary Contains only binary of the program
MEMREFLECT_PORT The port memreflect listen on
MEMREFLECT_SHUTDOWN Use shutdown together with flush_all command if set
docker run --network=host -d -e MEMREFLECT_PORT=11211 --cap-add net_admin gzmaxsum/memreflect
or
docker run --network=host -d -e MEMREFLECT_PORT=11211 --privileaged=true gzmaxsum/memreflect