TR
EN
AR
ES
FR
Command and Control Center
The central console where all test scenarios are defined, launched and managed live. The operator and the customer watch the same screen simultaneously.
What is inDDoS?
inDDoS is a cloud-based, automatically operated DDoS testing platform that lets organizations test their DDoS protection infrastructure with real attack parameters, managed through a web interface. It is a fully locally developed offensive security product built by Nesil Teknoloji's TSE A-approved penetration testing team. Tests are carried out only with the written permission of the target system's owner, under two-sided approval and emergency stop protection.
inDDoS tests whether your DDoS defenses survive a real attack. It targets network-layer capacity (L3/L4), application-layer services (L7) and DNS infrastructure, running 19+ vectors such as SYN Flood, HTTP/S Flood and DNS Query Flood with up to 4,000 bots, 36 Gbps of volumetric traffic and 6,000,000 concurrent L7 users.
Key Facts
| Product type | Cloud-based automated DDoS testing and resilience platform |
|---|---|
| Maximum capacity | 4,000 bots |
| Volumetric traffic (L3/L4) | Up to 36,000 Mbps (36 Gbps) with 600 bots |
| Application layer (L7) | Up to 6,000,000 concurrent users |
| Bandwidth per bot | 1–60 Mbps (depending on the attack type) |
| Number of attack vectors | 19+ (L3/L4 volumetric, L7 application, DNS) |
| Reporting time | Automatic as soon as the test ends; can be exported as PDF |
| Measurement metric | DDoS Resilience Score (1–10) |
| Security controls | Target ownership verification, two-factor approval, emergency stop, automatic timeout |
| Legal requirement | Written permission, authorization letter and NDA |
| Compliance context | DORA (EU 2022/2554), ISO/IEC 27001, KVKK Art. 12 |
| Operating models | Managed testing service, platform license (self-service), MSSP / partner |
| Service regions | Istanbul, Ankara, Izmir, Antalya – nationwide across Türkiye |
How Does inDDoS Work?
- 01Scan & Discover
- 02Controlled
Launch - 03Real-Time
Monitor - 04Report &
Improve
- Scenario Design
- 19+ Attack Types
- Layer 3-7
- Dual-Approval
Real-Time Monitoring
- 4,000+ Bot Capacity
- Legal Cloud Bots
- Operator or Self-Run
Auto-Run
- Bandwidth
- PPS
- RPS
- Response Health
- Emergency Stop
- Intervention
- DRS ScoreA data-driven attack score is calculated and risks are rated.
- AI ReportAn executive summary with key facts.
- Technical FindingsIn-depth analysis and evidence.
- Mitigation PlanPriority actions to increase resilience.
inDDoS is a cloud-based automated DDoS testing platform managed through a web interface. It directs traffic generated with real attack parameters at your target system and measures the limits and efficiency of your existing DDoS prevention solutions. Tests are started with a single click, monitored live, stopped in a controlled manner and repeated as many times as desired.
Distributed Bot Network
A geographically distributed bot fleet created on demand in the cloud. 1–60 Mbps per bot, scaling up to 4,000 bots in total. Regions can be selectively included or excluded.
Independent System Monitoring (Monitor)
While the attack is running, legitimate requests are sent through a separate bot; the target's real response time is measured with a TCP connection, DNS query, HTTP/S GET-POST and ECHO.
Test Capacity and Package Levels
The number of bots directly determines the volumetric bandwidth to be generated and the number of concurrent users at the application layer. Together we determine the right level based on your organization's current line capacity and protection architecture.
| Number of Bots | L3/L4 Volumetric Bandwidth (max Mbps) | L7 Application Layer (Concurrent Users) |
|---|---|---|
| 50 | 3,000 Mbps (3 Gbps) | 500,000 |
| 200 | 12,000 Mbps (12 Gbps) | 2,000,000 |
| 400 | 24,000 Mbps (24 Gbps) | 4,000,000 |
| 600 | 36,000 Mbps (36 Gbps) | 6,000,000 |
The platform scales up to 4,000 bots; capacities above 600 bots are planned on request. Bandwidth per bot ranges from 1 Mbps to 60 Mbps depending on the attack type. Packages can be upgraded to a higher level at any time.
Supported Attack Vectors
Multiple vectors can run simultaneously in a single test. The list below covers the most frequently used vectors; scenarios are customized according to your infrastructure architecture.
L3 / L4 – Volumetric & Protocol
Targets line capacity and state tables
- ICMP Flood
- UDP Flood
- Fragmented UDP Flood
- SYN Flood
- SYN-ACK Flood
- ACK-FIN Flood
- RST Flood
- PUSH-ACK Flood
- ALL TCP Flags Flood
- Ping of Death
- Empty Connection Flood
L7 – Application Layer
Targets web server, application and WAF behavior
- HTTP/S GET Flood
- HTTP/S POST Flood
- Slowloris
- RUDY (R-U-Dead-Yet)
- SSL Negotiation Flood
- SSL Squeeze
DNS Layer
Targets name resolution infrastructure
- DNS Query Flood
- DNS Random Query Flood
Scenario Flexibility
- Running multiple vectors simultaneously
- Gradual escalation of intensity (ramp-up)
- Region-based bot inclusion / exclusion
- Priority-ordered scenario chain
- Repeating the test as many times as desired
- Comparison of results across tests
Throughout the test, the Monitor component independently measures the target's response time under legitimate traffic using TCP, DNS, HTTP/S and ECHO.
Security Controls That Prevent Abuse
DDoS testing can only be carried out legally with the written permission of the target system's owner. inDDoS enforces this principle technically as well: target ownership is proven before a test is launched, and every test goes through two-sided approval.
Target Ownership Verification
Before the test, the FQDN, URL and IP address details are collected; a test cannot be defined until the customer's ownership of these assets is documented.
Two-Factor Test Approval
For a test to start, both the operator and the organization being tested must approve it. Unilateral initiation is not possible.
Emergency Stop Button
A running test can be stopped instantly with a single touch. In an unexpected situation the test is deliberately interrupted and restarted when necessary.
Automatic Attack Timeout
Running vectors terminate on their own once their duration ends. Even if the connection to the command center drops, the bot network completes every vector without an operator command.
Instant Cloud Access
In the event of a network failure, the operator accesses the cloud directly and brings the test under control; the risk of uncontrolled traffic generation is eliminated.
Mandatory Contract and NDA
All tests are carried out under a pre-signed authorization letter and confidentiality agreement. Test data is not shared with third parties.
inDDoS Autopilot – Fully Automatic Test Execution
Once a project has been set up, tests run as planned without operator intervention. It makes it possible to execute in a night window, a maintenance interval or a periodic verification schedule without waiting for a person.
Automatic Test Start
Initiation and uninterrupted execution that require no manual intervention.
Scenario Execution
Pre-configured attack scenarios are run in priority order.
Health Monitoring
Proactive detection of issues through automatic health checks.
Autonomous Reporting
A comprehensive post-test report is generated without needing live monitoring.
Manual Takeover
Instantly ending the test and switching to manual operation is possible at any time.
Reporting and the DDoS Resilience Score
The report is generated automatically as soon as the test ends; it is presented with charts and can be exported as PDF to share with auditors, management or third parties.
Contents of the Automatic Test Report
- Verification record confirming that the test was executed
- Identity of the operator who ran the test
- Bandwidth used throughout the test
- Packets per second (PPS) utilization
- Response time curve of the target system
- Applied vectors and duration details
- All data as graphical representation + PDF output
DDoS Resilience Score (1–10)
It is an empirical value calculated by taking the ratio of the target's response time before the test to its response time during the test. The higher the value, the greater the resilience.
As tests are repeated, scores are compared and the effect of fine-tuning applied to defense mechanisms is tracked as a trend. This gives the question "did the improvement really work?" a measurable answer.
Nesil Teknoloji Added Value
- Scenario design with the TSE A-approved penetration testing team
- Findings matrix prioritized by criticality level
- Performance interpretation of the WAF / IPS / DDoS protection system
- Mitigation recommendations: rate limiting, filtering, anycast, scrubbing center
- Separate report presentations for management and the technical team
- 30-day free follow-up session
- Discounted retest option
Why inDDoS Instead of Manual DDoS Testing?
In classic DDoS tests, preparation takes weeks, traffic generators are located on-premises, live monitoring during the test is often absent, and the report is written by hand days later. inDDoS changes this cycle entirely.
| Criterion | Traditional Manual Testing | inDDoS Platform |
|---|---|---|
| Preparation time | Weeks of hardware/configuration work | Single-click launch once the project is defined |
| Traffic source | Local traffic generators, limited source IP diversity | A geographically distributed bot network created in the cloud |
| Live monitoring | Usually absent or limited | Simultaneous real-time monitoring by all parties |
| Emergency stop | Manual intervention, delayed | Instant stop with a single touch + automatic timeout |
| Reporting | Manual reporting that takes days, not reusable | Automatic report with charts and PDF output as soon as the test ends |
| Repeatability | Re-setup every single time | The scenario is saved; unlimited repetition and comparison |
| Measurement | Subjective assessment | Trend analysis with the DDoS Resilience Score from 1 to 10 |
Who Is It For?
Organizations that commit to uninterrupted service continuity, have invested in DDoS protection and need to prove that this investment actually works.
Financial Institutions
Banks, payment institutions, brokerage firms and fintech platforms
E-Commerce Platforms
Marketplaces that require high traffic and an uninterrupted sales flow during campaign periods
SaaS and Cloud Providers
Service providers that commit to SLAs and operate multi-tenant infrastructure
Telecom and ISPs
Operators that need to validate their backbone capacity and scrubbing investment
Public Sector and Critical Infrastructure
Institutions delivering citizen services, and energy, transportation and healthcare infrastructures
Gaming and Media
Platforms requiring live streaming, game servers and high concurrency
Compliance and Audit Evidence
Regulatory frameworks now demand proof of a protection solution's effectiveness, not merely its existence. inDDoS outputs make this evidence documentable.
DORA (EU 2022/2554)
The requirement to validate systems under real threat conditions as part of digital operational resilience testing.
ISO/IEC 27001
Objective test evidence regarding the effectiveness of availability, capacity management and business continuity controls.
KVKK Art. 12
Verification of the technical measures taken to protect the availability of systems where personal data is processed.
Business Continuity and SLA
Supporting the availability commitments made to customers with a measurable resilience score.
Three Different Operating Models
Let us run the test, run it yourself, or offer it to your own customers. Together we choose the model that fits your organization.
Managed Testing Service
Tests are run by Nesil Teknoloji's authorized inDDoS operators. Scenario design, live execution, findings analysis and executive presentation are included.
- Scope and scenario consulting
- Live test accompanied by an operator
- Interpreted technical report
- Improvement roadmap
Platform License (Self-Service)
inDDoS portal access is provisioned directly for your organization. After training, your team plans and runs the tests itself whenever it wants.
- Packages based on bot level
- Term license, upgrade to a higher package
- Scheduled tests with Autopilot
- User training and technical support
MSSP / Partner Model
For organizations providing managed security services, the ability to add a DDoS testing service to their own customer portfolio.
- Multi-customer management
- Operator training and authorization
- Sales and technical support
- Joint go-to-market plan
How Does the Process Work?
STEP 1
Preliminary Assessment
Your current architecture, line capacity and protection solutions are analyzed; the test scope and objectives are determined.
STEP 2
Authorization and Contract
Ownership of the target assets (FQDN, URL, IP) is verified; the authorization letter and NDA are signed.
STEP 3
Scenario Definition
The number of bots, vector combination, region distribution, duration and escalation plan are defined in the platform; the emergency procedure is established.
STEP 4
Execution with Dual Approval
The test starts with the approval of both the operator and the organization. All parties watch live; intensity is escalated gradually and stopped instantly when necessary.
STEP 5
Report and Retest
The report is generated instantly and presented with expert commentary. After improvements, a retest measures the change in the resilience score.