Source: blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/

Want to scan your network? Get the memcached nmap script.

https://nmap.org/nsedoc/scripts/memcached-info.html

Nmap the network for open memcached ports (example, replace with your range).

sudo nmap 127.0.0.1/18 -p 11211 -sU -sS --script memcached-info >> memcrashed.log

Sort nmap log and find IPs that are actually vuln.

cat memcrashed.log | grep -B 16 Authentication | grep -E -o "([0-9]{1,3}[\.]){3}[0-9]{1,3}" >> sorted_memcrashed.log

You can verify with this one liner.

cat sorted_memcrashed.log | while read a; do echo -en "\x00\x00\x00\x00\x00\x01\x00\x00stats\r\n" | nc -q1 -u $a 11211 ; done