This implementation allows ESpanix to offer protection against DDoS attacks as a new optional value-added service to the more than 200 national and international networks that exchange traffic at the ESpanix node and that, together, serve the vast majority of end users of the Internet in Spain.
DDoS attacks continue to increase in magnitude, frequency, and sophistication, with massive botnets comprised of compromised IoT devices and residential proxies used as weapons to launch hypervolumetric and application-layer attacks against networks, services, and end users. As a central crossroads of the internet in Spain, the ESpanix Node occupies a strategic position: stopping attack traffic at the exchange point prevents it from ever reaching the networks—businesses, utilities, and consumers—behind its ports.
“DDoS attacks remain a major threat to our networks connected daily. Integrating a proactive detection and mitigation solution into our infrastructure represents a significant step forward in ESpanix’s ongoing commitment to maximizing security across our entire service portfolio. Leveraging the exceptional detection granularity of Nokia Deepfield, we can substantially reduce the impact of DDoS incidents by isolating and removing only the unwanted traffic.” It is crucial to highlight that this protection is provided entirely within our network and in Spain, through the six data centers in Madrid and Barcelona where we connect with our members. This ensures that local traffic remains local, eliminating any need for routing through third-party debugging infrastructure and thus guaranteeing strict data sovereignty. By unifying these capabilities, we have significantly simplified the implementation and operation of DDoS protection, ensuring that our end users do not need specific technical expertise to enjoy robust and uninterrupted defense. “This new service increases the value of connecting to the ESpanix node and adds a new dimension to the services we offer our members,” said Javier Achirica, Technical Director of ESpanix.
“Internet exchange points are critical infrastructure, and in the case of Spain, ESpanix is the convergence point of the national internet network, making it the ideal location to stop DDoS attacks. With Deepfield Defender, ESpanix detects and eliminates attack traffic in seconds, directly on the network and within the country. This implementation demonstrates how internet exchange points across Europe can transform security into greater resilience for their members and, at the same time, a new source of value,” said Jeff Smith, Vice President and General Manager of Nokia Deepfield.
Nokia Deepfield Defender combines AI-powered big data analysis of network telemetry with Deepfield Secure Genome®, Nokia's proprietary cloud-based data source that tracks the internet's security context. Defender detects all types of DDoS attacks in seconds and drives highly granular, automated, network-based mitigation, precisely removing only unwanted traffic while legitimate packets continue to flow. By unifying detection and mitigation within the network itself, ESpanix avoids redirecting its members' traffic to external cleanup centers: attacks are identified and eliminated where traffic flows, keeping Spanish internet traffic and the responsibility for protecting it within Spain.
This implementation expands a collaboration that, in 2025, made ESpanix the first IXP in Spain to offer 400G connectivity to its customers, based on Nokia interconnection and service routers operating on Nokia's optical transport network. With Deepfield Defender, ESpanix joins a growing group of leading European Internet Exchange Points (IXPs) using Nokia Deepfield to protect their members and create new security services on their interconnection platforms. For exchange points, the deployment model has a multiplier effect: a single implementation at one exchange point extends protection to all networks connecting through it.
The new DDoS protection service will be presented to the ESpanix community and the wider industry at upcoming events.
