{"id":300,"date":"2026-09-09T10:50:57","date_gmt":"2026-09-09T10:50:57","guid":{"rendered":"https:\/\/www.dorabase.com\/blog\/?p=300"},"modified":"2026-09-09T10:50:58","modified_gmt":"2026-09-09T10:50:58","slug":"ddos-nedir-nasil-engellenir","status":"publish","type":"post","link":"https:\/\/www.dorabase.com\/blog\/ddos-nedir-nasil-engellenir\/","title":{"rendered":"DDoS Nedir, Nas\u0131l Engellenir?"},"content":{"rendered":"\n

Panelde ani bir trafik patlamas\u0131 g\u00f6r\u00fcn\u00fcyor. Ajans “bulut koruma alal\u0131m” diyor, hosting sa\u011flay\u0131c\u0131s\u0131 “bizde DDoS koruma zaten dahil” diyor, a\u011f ekibi ise “biz sald\u0131r\u0131y\u0131 upstream’de zaten karart\u0131yoruz” diyor, \u00fc\u00e7\u00fc de farkl\u0131 bir katmandan konu\u015fuyor ve hi\u00e7biri ayn\u0131 \u015feyi kastetmiyor. Oysa “ddos nedir” sorusunun cevab\u0131 kadar, sald\u0131r\u0131n\u0131n hangi katmanda ger\u00e7ekle\u015fti\u011fini ay\u0131rt etmek de belirleyici; \u00e7\u00fcnk\u00fc yanl\u0131\u015f katmana yap\u0131lan yat\u0131r\u0131m sald\u0131r\u0131 an\u0131nda hi\u00e7bir i\u015fe yaram\u0131yor. Bu rehber \u00fc\u00e7 \u015feyi netle\u015ftiriyor: sald\u0131r\u0131n\u0131n hangi katmanda oldu\u011funu ay\u0131rt etmek, korumay\u0131 do\u011fru yere konumland\u0131rmak ve T\u00fcrkiye’de bu konuda yasal olarak neyin zorunlu oldu\u011funu bilmek.<\/p>\n\n\n\n

\n

\u0130\u00e7indekiler<\/p>\n

    \n
  1. DDoS Nedir?<\/a><\/li>\n
  2. DoS ile DDoS Aras\u0131ndaki Fark Nedir?<\/a><\/li>\n
  3. Botnet Nedir ve Sald\u0131r\u0131 Nas\u0131l Kurulur?<\/a><\/li>\n
  4. DDoS Sald\u0131r\u0131 T\u00fcrleri Hangi Katmanda \u00c7al\u0131\u015f\u0131r?<\/a><\/li>\n
  5. DDoS Sald\u0131r\u0131s\u0131 Oldu\u011funu Nas\u0131l Anlars\u0131n\u0131z?<\/a><\/li>\n
  6. DDoS Sald\u0131r\u0131s\u0131 Nas\u0131l Engellenir? 6 Katman<\/a><\/li>\n
  7. Koruma Nereye Konu\u015fland\u0131r\u0131l\u0131r?<\/a><\/li>\n
  8. DDoS Korumas\u0131 Neyi \u00c7\u00f6zer, Neyi \u00c7\u00f6zmez?<\/a><\/li>\n
  9. T\u00fcrkiye’de DDoS: 7545 Say\u0131l\u0131 Kanun Ne Getiriyor?<\/a><\/li>\n
  10. Sonu\u00e7<\/a><\/li>\n
  11. S\u0131k\u00e7a Sorulan Sorular<\/a><\/li>\n <\/ol>\n<\/div>\n\n\n\n

    DDoS Nedir?<\/h2>\n\n\n\n

    DDoS (Distributed Denial of Service \/ Da\u011f\u0131t\u0131k Hizmet Engelleme), bir sistemin ta\u015f\u0131yabilece\u011finden fazla iste\u011fi \u00e7ok say\u0131da farkl\u0131 kaynaktan ayn\u0131 anda g\u00f6ndererek hizmeti eri\u015filemez hale getiren sald\u0131r\u0131 t\u00fcr\u00fcd\u00fcr. Ama\u00e7 veri \u00e7almak de\u011fil, hizmeti durdurmakt\u0131r; bu y\u00fczden ba\u015far\u0131s\u0131 sistemin kapasite s\u0131n\u0131r\u0131yla \u00f6l\u00e7\u00fcl\u00fcr. Sald\u0131r\u0131n\u0131n hedefi gizlilik de\u011fil eri\u015filebilirliktir. DDoS, verinize de\u011fil, hizmete eri\u015fiminize y\u00f6nelir. Kapasite s\u0131n\u0131r\u0131 \u00fc\u00e7 farkl\u0131 noktada ortaya \u00e7\u0131kabilir: bant geni\u015fli\u011finde, sunucunun ba\u011flant\u0131 tablosunda veya uygulaman\u0131n i\u015flem g\u00fcc\u00fcnde. IETF’in RFC 4732 belgesi, hizmet reddi durumunu bir sistemin me\u015fru kullan\u0131c\u0131lara sundu\u011fu hizmet kalitesinin kas\u0131tl\u0131 olarak d\u00fc\u015f\u00fcr\u00fclmesi olarak tan\u0131mlar; DDoS ise bunu tek bir kaynaktan de\u011fil, \u00e7ok say\u0131da kaynaktan e\u015fzamanl\u0131 \u015fekilde yapar. \u00d6zetle ddos nedir sorusunun teknik cevab\u0131 budur: kapasiteyi a\u015fan, da\u011f\u0131t\u0131k kaynakl\u0131 bir eri\u015filebilirlik sald\u0131r\u0131s\u0131.<\/p>\n\n\n\n

    \n

    \n Altyap\u0131n\u0131z\u0131n hangi katmanda a\u00e7\u0131k oldu\u011fundan emin de\u011fil misiniz? \u00dccretsiz risk de\u011ferlendirmesi isteyin.\n <\/p>\n \n \u00dccretsiz De\u011ferlendirme \u2192\n <\/a>\n<\/div>\n\n\n\n

    DoS ile DDoS Aras\u0131ndaki Fark Nedir?<\/h3>\n\n\n\n

    DoS sald\u0131r\u0131s\u0131 tek bir kaynaktan, DDoS ise binlerce farkl\u0131 kaynaktan gelir; aradaki fark yaln\u0131zca \u00f6l\u00e7ek de\u011fil, savunma y\u00f6nteminin tamamen de\u011fi\u015fmesidir. Tek kayna\u011f\u0131 IP baz\u0131nda engellemek m\u00fcmk\u00fcnd\u00fcr, da\u011f\u0131t\u0131k kayna\u011f\u0131 engellemek ise trafi\u011fin tamam\u0131n\u0131 s\u0131n\u0131fland\u0131rmay\u0131 gerektirir. Bu y\u00fczden “IP’yi engelle, i\u015f biter” refleksi DDoS’ta i\u015flemez: binlerce farkl\u0131 IP’den gelen trafi\u011fi tek tek engellemeye \u00e7al\u0131\u015fmak hem operasyonel olarak imk\u00e2ns\u0131zd\u0131r hem de me\u015fru kullan\u0131c\u0131lar\u0131 filtrenin d\u0131\u015f\u0131nda b\u0131rakma riski ta\u015f\u0131r. Google’\u0131n “ddos nedir” aramas\u0131nda g\u00f6sterdi\u011fi \u00f6zet blok da okuru do\u011frudan bu ayr\u0131ma y\u00f6nlendiriyor; \u00e7\u00fcnk\u00fc savunman\u0131n ilk ad\u0131m\u0131, sald\u0131r\u0131n\u0131n kaynak say\u0131s\u0131n\u0131 do\u011fru tahmin etmekten ge\u00e7iyor.<\/p>\n\n\n\n

    Botnet Nedir ve Sald\u0131r\u0131 Nas\u0131l Kurulur?<\/h3>\n\n\n\n

    Botnet, sahiplerinin haberi olmadan ele ge\u00e7irilmi\u015f cihazlardan olu\u015fan ve tek bir merkezden y\u00f6netilen a\u011fd\u0131r; DDoS sald\u0131r\u0131lar\u0131n\u0131n da\u011f\u0131t\u0131k kayna\u011f\u0131n\u0131 bu a\u011f sa\u011flar. G\u00fcn\u00fcm\u00fczde botnetlerin \u00f6nemli b\u00f6l\u00fcm\u00fc g\u00fcncellenmemi\u015f y\u00f6nlendirici, kamera ve IoT cihazlar\u0131ndan kurulur. Sald\u0131r\u0131 \u00fc\u00e7 a\u015famada kurulur: \u00f6nce cihazlar bir zafiyet veya varsay\u0131lan \u015fifre \u00fczerinden ele ge\u00e7irilir, ard\u0131ndan bir komuta-kontrol sunucusu \u00fczerinden a\u011f y\u00f6netilir, son olarak sald\u0131rgan tek bir komutla binlerce cihaz\u0131 ayn\u0131 anda hedefe y\u00f6nlendirir. Kiralanabilir sald\u0131r\u0131 hizmetlerinin varl\u0131\u011f\u0131, bu s\u00fcrecin ileri d\u00fczey teknik bilgi gerektirmeden ba\u015flat\u0131labildi\u011fi anlam\u0131na gelir. \u00dcstelik sald\u0131r\u0131ya kat\u0131lan cihazlar\u0131n bir k\u0131sm\u0131 sizin a\u011f\u0131n\u0131zda da olabilir; g\u00fcncellenmemi\u015f bir y\u00f6nlendirici veya IP kamera, haberiniz olmadan bir botnet’in par\u00e7as\u0131 h\u00e2line gelebilir.<\/p>\n\n\n\n

    \n

    \n <\/strong> Botnet trafi\u011fi tan\u0131m gere\u011fi “ger\u00e7ek” cihazlardan gelir; bu y\u00fczden kayna\u011f\u0131n me\u015fru g\u00f6r\u00fcnmesi sald\u0131r\u0131 olmad\u0131\u011f\u0131n\u0131n kan\u0131t\u0131 de\u011fildir.\n <\/p>\n<\/div>\n\n\n\n

    DDoS Sald\u0131r\u0131 T\u00fcrleri Hangi Katmanda \u00c7al\u0131\u015f\u0131r?<\/h3>\n\n\n\n

    DDoS sald\u0131r\u0131lar\u0131 hedef ald\u0131klar\u0131 katmana g\u00f6re \u00fc\u00e7e ayr\u0131l\u0131r: hatt\u0131 dolduran volumetrik sald\u0131r\u0131lar, ba\u011flant\u0131 tablosunu t\u00fcketen protokol sald\u0131r\u0131lar\u0131 ve uygulamay\u0131 yoran istek sald\u0131r\u0131lar\u0131. Katman\u0131 do\u011fru belirlemek \u00f6nemlidir, \u00e7\u00fcnk\u00fc her katman farkl\u0131 bir yerde ve farkl\u0131 bir y\u00f6ntemle durdurulur. A\u015fa\u011f\u0131daki tablo, en s\u0131k g\u00f6r\u00fclen be\u015f sald\u0131r\u0131 t\u00fcr\u00fcn\u00fc katman\u0131na, sizde nas\u0131l g\u00f6r\u00fcnd\u00fc\u011f\u00fcne ve do\u011fru kar\u015f\u0131 \u00f6nleme g\u00f6re ay\u0131r\u0131yor.<\/p>\n\n\n

    \n
    \"DDoS<\/figure>\n<\/div>\n\n\n
    \n\n \n \n \n \n \n \n \n \n
    Sald\u0131r\u0131 t\u00fcr\u00fc<\/th>\n Katman<\/th>\n Ne yapar<\/th>\n Sizde nas\u0131l g\u00f6r\u00fcn\u00fcr<\/th>\n Do\u011fru kar\u015f\u0131 \u00f6nlem<\/th>\n <\/tr>\n <\/thead>\n
    Volumetrik (UDP\/ICMP flood, amplifikasyon)<\/td>\n L3<\/td>\n Hatt\u0131 doldurur<\/td>\n Bant geni\u015fli\u011fi %100, sunucu CPU normal<\/td>\n Yukar\u0131 ak\u0131\u015fta scrubbing, kendi kenar\u0131n\u0131zda \u00e7\u00f6z\u00fclemez<\/td>\n <\/tr>\n
    Protokol (SYN\/ACK flood)<\/td>\n L4<\/td>\n Ba\u011flant\u0131 tablosunu t\u00fcketir<\/td>\n Yeni ba\u011flant\u0131 a\u00e7\u0131lm\u0131yor, mevcut oturumlar s\u00fcr\u00fcyor<\/td>\n SYN cookie, ba\u011flant\u0131 limitleri, scrubbing<\/td>\n <\/tr>\n
    Uygulama (HTTP GET\/POST flood)<\/td>\n L7<\/td>\n Pahal\u0131 sayfay\u0131 tekrar tekrar \u00e7a\u011f\u0131r\u0131r<\/td>\n Bant geni\u015fli\u011fi normal, veritaban\u0131 ve CPU t\u00fckenmi\u015f<\/td>\n WAF<\/a> + rate limiting + bot ayr\u0131\u015ft\u0131rma<\/a><\/td>\n <\/tr>\n
    Yava\u015f ba\u011flant\u0131 (Slowloris)<\/td>\n L7<\/td>\n Ba\u011flant\u0131lar\u0131 a\u00e7\u0131k tutar<\/td>\n Az trafikle i\u015f par\u00e7ac\u0131klar\u0131 dolu<\/td>\n Zaman a\u015f\u0131m\u0131 s\u0131k\u0131la\u015ft\u0131rma, ters vekil sunucu<\/td>\n <\/tr>\n
    DNS tabanl\u0131<\/td>\n L3\/L4<\/td>\n Ad \u00e7\u00f6z\u00fcmlemeyi hedefler<\/td>\n Site ayakta ama alan ad\u0131 \u00e7\u00f6z\u00fclm\u00fcyor<\/td>\n Anycast DNS<\/a>, ayr\u0131 DNS korumas\u0131<\/td>\n <\/tr>\n <\/tbody>\n<\/table>\n<\/div>\n\n\n\n
    \n

    \n <\/strong> Bant geni\u015fli\u011fi normalken sunucu t\u00fckeniyorsa sald\u0131r\u0131 L7’dir ve hat kapasitesi almak i\u015fe yaramaz, yanl\u0131\u015f katmana b\u00fct\u00e7e harcaman\u0131n en s\u0131k g\u00f6r\u00fclen bi\u00e7imi budur.\n <\/p>\n<\/div>\n\n\n\n

    Tablodaki DNS tabanl\u0131 sat\u0131r \u00f6zellikle g\u00f6zden ka\u00e7ar: site ayakta oldu\u011fu h\u00e2lde alan ad\u0131 \u00e7\u00f6z\u00fclmedi\u011fi i\u00e7in “her \u015fey \u00e7\u00f6km\u00fc\u015f” g\u00f6r\u00fcn\u00fcr. Bu senaryoya kar\u015f\u0131 ad \u00e7\u00f6z\u00fcmleme katman\u0131n\u0131 da co\u011frafi olarak da\u011f\u0131t\u0131lm\u0131\u015f bir yap\u0131yla ayr\u0131ca g\u00fc\u00e7lendirmek gerekir.<\/p>\n\n\n\n

    DDoS Sald\u0131r\u0131s\u0131 Oldu\u011funu Nas\u0131l Anlars\u0131n\u0131z?<\/h3>\n\n\n\n

    DDoS sald\u0131r\u0131s\u0131, trafik art\u0131\u015f\u0131n\u0131n kaynak da\u011f\u0131l\u0131m\u0131 ile i\u00e7erik talebi aras\u0131ndaki tutars\u0131zl\u0131ktan anla\u015f\u0131l\u0131r: ger\u00e7ek bir kampanya trafi\u011fi belirli sayfalara ve bilinen co\u011frafyalara yo\u011funla\u015f\u0131r, sald\u0131r\u0131 trafi\u011fi ise da\u011f\u0131n\u0131k kaynaklardan gelir ve d\u00f6n\u00fc\u015f\u00fcm \u00fcretmez. A\u015fa\u011f\u0131daki be\u015f sinyal bir arada g\u00f6r\u00fcld\u00fc\u011f\u00fcnde, \u00f6n\u00fcn\u00fczdeki tablo b\u00fcy\u00fck olas\u0131l\u0131kla bir DDoS’tur:<\/p>\n\n\n\n