ESpanix deploys Nokia Deepfield Defender at Spain's main IXP

ESpanix, Spain's largest internet exchange point (IXP), has deployed Nokia Deepfield Defender across its Barcelona and Madrid nodes, enabling the exchange to offer DDoS protection as a new optional service to the more than 200 national and international networks that transit its platform.

The deployment means that attack traffic can be detected and removed within seconds, directly inside the ESpanix network, without rerouting member traffic to external scrubbing centres. ESpanix operates across six data centres spanning the Madrid and Barcelona metropolitan areas, and together its connected members serve the majority of internet end users in Spain.

How the technology works

Nokia Deepfield Defender combines AI-driven analytics of network telemetry with the vendor's Deepfield Secure Genome, a proprietary cloud-based data feed that tracks the security context of the internet in real time. The system identifies volumetric and application-layer attacks and triggers automated, in-network mitigation with what Nokia describes as surgical precision, removing only malicious traffic while allowing legitimate packets to continue flowing.

Javier Achirica, CTO at ESpanix, said the in-network approach was chosen partly on sovereignty grounds: "This protection is delivered entirely within our network and within Spain, across the six datacentres in Madrid and Barcelona where we connect with our members. This ensures that local traffic remains local, eliminating any need for detours through third-party scrubbing infrastructure and thereby guaranteeing strict data sovereignty."

Jeff Smith, Vice President and General Manager of Nokia Deepfield, positioned IXPs as a structurally efficient place to stop attacks. "Internet exchanges are critical infrastructure, and for Spain, ESpanix is where the national internet comes together, which also makes it the smartest place to stop DDoS attacks," he said.

The announcement extends an existing relationship between the two organisations. In 2025, Nokia supplied the interconnect and service routers that made ESpanix the first IXP in Spain to offer 400G connectivity to its members.

Market context and regulatory backdrop

The deployment sits at the intersection of two accelerating trends in European network infrastructure: the growing scale and frequency of DDoS attacks, driven in part by botnets of compromised IoT devices and weaponised residential proxies, and sharpening regulatory expectations around data localisation.

On the regulatory side, the EU's NIS2 Directive, which came into force in October 2024, classifies internet exchange points as essential entities and requires them to implement appropriate technical measures to manage network security risks. Keeping traffic scrubbing inside national borders also aligns with the broader Digital Sovereignty agenda that EU member states have been pressing since the European Data Act and related instruments began moving through the legislative process.

Nokia claims ESpanix joins a growing cohort of European IXPs using Deepfield for member protection, though the company did not name other deployments or publish comparative performance benchmarks in its release. The competitive field for IXP-level DDoS mitigation includes specialist vendors such as Corero Network Security and NETSCOUT Arbor, as well as scrubbing services offered directly by transit providers.

Outlook

For ESpanix, the commercial logic is a multiplier effect: a single platform-level deployment extends protection to every network that peers at the exchange, allowing the IXP to monetise security as a value-added service without requiring member-side configuration changes. The company said the new service will be introduced to the wider industry at forthcoming events, though it did not specify dates or pricing.

Buyers evaluating DDoS mitigation at the network edge will want to see published figures on mitigation latency, false-positive rates, and the maximum attack volumes the system has absorbed in production before drawing conclusions about the service's positioning against cloud-scrubbing alternatives.