ESpanix deploys Nokia Deepfield Defender to protect Iberian internet traffic from DDoS attacks

ESpanix is the leading IP traffic exchange in Portugal and Spain and one of the main IP interconnection points in southern Europe. For more than 25 years, it has carried internet traffic across the Iberian Peninsula, growing into a neutral hub where access operators from both countries meet the world's largest cloud, content and carrier networks. Its motto captures its place in the region's internet: “Si pasa en Internet, pasa por ESpanix” — if it happens on the internet, it passes through ESpanix.

The ESpanix Node connects more than 200 customer networks across six points of presence in the metropolitan areas of Barcelona, Lisbon and Madrid, including most national internet service providers (ISPs), content and cloud providers, and national and international carriers. The Node switches more than 2 Tb/s of traffic on 260 Tb/s of installed capacity, and a single connection gives access to most networks operating across the peninsula. As Amedeo Beck Peccoz, Head of Strategy at ESpanix, puts it, connecting with ESpanix means connecting with “the complete ecosystem where neutrality, scale and physical proximity guarantee the performance that digital operations demand.”

Neutral by design, ESpanix is governed by a non-profit association whose board of directors is drawn from the organizations that connect to it. The company works across three business areas — interconnection, datacenters and value-added services — and holds ISO 27001 and ISO 9001 certifications, as well as certification at the “High” level of Spain's ENS security scheme (Esquema Nacional de Seguridad). In 2026 its traffic grew by more than 12 percent, with peaks above 2 Tb/s becoming increasingly frequent.

ESpanix and Nokia have worked together since 2025, when ESpanix became the first IXP in Spain to offer 400G connectivity, built on Nokia 7250 Interconnect Routers (IXRs), Nokia 7750 Service Routers (SRs) and the Nokia 1830 Photonic Service Switch (PSS). The upgrade placed a programmable Nokia IP routing fabric with built-in security capabilities at every ESpanix point of presence — the foundation for DDoS protection performed by the very routers that forward member traffic.

DDoS attacks continue to grow in size, frequency and complexity. Massive botnets of compromised IoT devices and weaponized residential proxies drive hyper-volumetric and application-layer attacks against networks, services and end users. As the central crossroads of the Iberian internet, the ESpanix Node plays a key strategic role: stopping malicious traffic at the exchange keeps it from reaching the networks, businesses, public services and consumers behind its ports.
For an exchange, the traditional approach to DDoS security has been to stay neutral: forward every packet, legitimate or malicious, and leave protection to each connected network. Members then source DDoS protection individually, often from external scrubbing providers beyond national borders. Traffic is diverted away from the exchange, latency and costs rise, and responsibility for securing domestic traffic shifts outside the region. ESpanix wanted a different answer: detection and mitigation integrated into its own infrastructure, offered to its members as a service.

ESpanix needed DDoS protection that would:

• Detect and mitigate all types of DDoS attacks in seconds, before attack traffic reaches member ports
• Isolate and remove only unwanted traffic, so legitimate packets keep flowing
• Cover every point of presence and keep local traffic local, with no third-party scrubbing detours
• Unify detection and mitigation, so members and their end users need no specific technical expertise
• Run on the Nokia routing fabric ESpanix already operates, with no appliances added to the data path
• Increase the value of connecting to the ESpanix Node and add a new dimension to its service portfolio

ESpanix selected and deployed Nokia Deepfield Defender to protect its exchange platform and connected networks. Deployment was completed across the ESpanix Node in 2026, and the new DDoS protection service was introduced to the ESpanix community and the wider industry in September 2026. ESpanix now offers it as an optional value-added service to any of the more than 200 networks connected to the Node, across the datacenters in Lisbon, Madrid and Barcelona where it connects with its members.

Deepfield Defender combines network data — including flow telemetry, DNS and BGP — with Nokia Deepfield Secure Genome®, a patented, cloud-based data feed that continuously tracks the security context of the internet across more than five billion IPv4 and IPv6 addresses. By correlating that knowledge with what it sees in the ESpanix network, Defender detects all types of DDoS attacks in seconds, uses AI and machine learning to calculate the optimal mitigation strategy for each attack in real time, and instructs routers to apply precise filters that remove only unwanted traffic.

Mitigation is performed at line rate by the Nokia 7750 Service Routers, powered by Nokia FP network processors, that already forward member traffic at every ESpanix point of presence. No appliance is added to the path, and no attack traffic is backhauled across the network. Because detection and mitigation happen inside ESpanix's network, local traffic remains local, with no detour through third-party scrubbing infrastructure. The Deepfield Emergency Response Team Support (ERTS) service adds Nokia security experts, available 24/7, to ESpanix's own engineering and operations teams.

When the service was announced in September 2026, it covered ESpanix's points of presence in Spain, in Madrid and Barcelona. In October 2026, ESpanix extended it to Portugal, so members that connect in Lisbon are protected in the same way and the service now spans the Iberian Peninsula.

With Deepfield Defender in place, subscribing members are protected at the exchange, before attack traffic reaches their ports. As ESpanix's CTO notes, “Our end users need no specific technical expertise to enjoy robust, seamless defense.”
The service delivers:

• For members: fewer and shorter outages and service degradations
• For members: protection where they already connect, in Barcelona, Madrid and Lisbon, with local traffic kept local
• For members: a new reason to connect to the ESpanix Node
• For ESpanix: security as a service line within its value-added services business area
• For Spain and Portugal: greater resilience of the shared internet, with attacks stopped centrally at the region's main exchange
• For Spain and Portugal: protection delivered within national borders, in line with European digital-sovereignty expectations

For an internet exchange, the model has a multiplier effect: a single deployment extends protection to every network that chooses to connect through it, as well as the businesses, public services and consumers they serve. ESpanix joins a growing group of leading European internet exchanges that use Nokia Deepfield to protect their members and build new security services on top of their interconnection platforms — a model that any IXP, and the ISPs, hosting providers and enterprises that peer at one, can follow.