{"record":{"id":"8aef8dea94da264a","repo":"shadow1ng/fscan","slug":"i18n-tr-service-not-identified-memcached","errorCode":null,"errorMessage":"i18n.Tr(\"service_not_identified\", \"Memcached\")","messagePattern":"i18n\\.Tr\\(\"service_not_identified\", \"Memcached\"\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"plugins/services/memcached.go","lineNumber":143,"sourceCode":"\t\t}\n\t}\n\tdefer func() { _ = conn.Close() }()\n\n\tif p.testBasicCommand(conn, session.Config) {\n\t\tbanner := \"Memcached\"\n\t\tsession.LogSuccess(i18n.Tr(\"memcached_service\", target, banner))\n\t\treturn &ScanResult{\n\t\t\tType:    plugins.ResultTypeService,\n\t\t\tSuccess: true,\n\t\t\tService: \"memcached\",\n\t\t\tBanner:  banner,\n\t\t}\n\t}\n\n\treturn &ScanResult{\n\t\tSuccess: false,\n\t\tService: \"memcached\",\n\t\tError:   fmt.Errorf(\"%s\", i18n.Tr(\"service_not_identified\", \"Memcached\")),\n\t}\n}\n\nfunc init() {\n\tRegisterPluginWithPorts(\"memcached\", func() Plugin {\n\t\treturn NewMemcachedPlugin()\n\t}, []int{11211, 11212, 11213})\n}\n","sourceCodeStart":125,"sourceCodeEnd":152,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/memcached.go#L125-L152","documentation":"identifyService returns this error when the TCP connection succeeded but the 'version' probe did not receive a response containing 'VERSION' or 'memcached' (testBasicCommand returned false). The port is open, but fscan cannot confirm the service is actually memcached, so it reports 'service not identified: Memcached'.","triggerScenarios":"Running the memcached plugin (DisableBrute mode or via Scan) against an open port 11211-11213 where the server responds to 'version\\r\\n' with unexpected data, an empty reply, a read timeout, or a write error.","commonSituations":"A different service (proxy, honeypot, custom daemon) bound to 11211; memcached behind a TLS wrapper or proxy that speaks first; memcached configured with a modified/limited protocol response; IDS/IPs that tarpit protocol probes.","solutions":["Manually probe the port (printf 'version\\r\\n' | nc <host> 11211) to see the actual banner.","Identify what service is really listening on the port (banner grabbing, ss/netstat on the target).","If a proxy wraps memcached, scan the memcached host directly instead.","Increase ModuleTimeout if slow responses cause the read deadline to expire.","Accept the result as expected behavior for non-memcached services on memcached ports."],"exampleFix":"// before\n// plugin side: testBasicCommand only accepts \"VERSION\" or \"memcached\" substrings\n// after\n// caller side: treat 'service not identified' as inconclusive, not fatal\nres := plugin.Scan(ctx, info, session)\nif !res.Success && strings.Contains(fmt.Sprint(res.Error), \"not identified\") {\n    log.Printf(\"port open on %s but not memcached; run generic banner grab\", target)\n}","handlingStrategy":"fallback","validationCode":"func bannerIsMemcached(target string, timeout time.Duration) bool {\n\tconn, err := net.DialTimeout(\"tcp\", target, timeout)\n\tif err != nil { return false }\n\tdefer conn.Close()\n\tconn.SetDeadline(time.Now().Add(timeout))\n\tconn.Write([]byte(\"version\\r\\n\"))\n\tbuf := make([]byte, 1024)\n\tn, err := conn.Read(buf)\n\treturn err == nil && (strings.Contains(string(buf[:n]), \"VERSION\") || strings.Contains(string(buf[:n]), \"memcached\"))\n}","typeGuard":"func isNotIdentified(r *services.ScanResult) bool {\n\treturn r != nil && !r.Success && r.Error != nil && strings.Contains(r.Error.Error(), \"not identified\")\n}","tryCatchPattern":"result := plugin.Scan(ctx, info, session)\nif !result.Success && isNotIdentified(result) {\n\tbanner := genericBannerGrab(target, 3*time.Second)\n\tlog.Printf(\"port open on %s but not confirmed memcached; got banner: %q\", target, banner)\n}","preventionTips":["Grab a generic banner on open ports to identify what really listens there","Don't assume any service on 11211 is memcached — honeypots and proxies are common","Use generous read deadlines; first-response latency can exceed the default timeout","Exclude non-memcached hosts from the memcached plugin's port list"],"tags":["memcached","service-identification","banner","protocol"],"backgroundTag":"service-identification-failed","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}