ESpanix Adds Nokia Deepfield DDoS Protection for 200+ Member Networks

Nokia announced on September 14, 2026, that ESpanix, Spain’s largest internet exchange point, has selected and deployed Nokia Deepfield Defender to protect its exchange platform and connected networks against distributed denial-of-service (DDoS) attacks. The deployment enables ESpanix to offer DDoS protection as a new, optional value-added service to the more than 200 national and international networks that exchange traffic at the ESpanix Node and that, Nokia said, together serve the vast majority of internet end users in Spain.

According to Nokia’s announcement, the AI-driven security detects and mitigates attacks that cross the Barcelona- and Madrid-based exchange platform within seconds. Nokia said the in-network protection keeps Spanish internet traffic, and the responsibility for securing it, inside Spain, supporting data sovereignty and European regulatory expectations.

Nokia said DDoS attacks continue to grow in size, frequency, and sophistication, with massive botnets of compromised Internet of Things devices and weaponized residential proxies driving hyper-volumetric and application-layer attacks against networks, services, and end users. The company described the ESpanix Node as the central crossroads of the Spanish internet, and said stopping attack traffic at the exchange prevents it from reaching the networks, businesses, public services, and consumers behind its ports.

ESpanix chief technology officer Javier Achirica said DDoS attacks remain a primary threat to the exchange’s connected networks on a daily basis. He said integrating a proactive detection and mitigation solution into ESpanix infrastructure represents a significant step forward in the exchange’s ongoing commitment to maximizing security across its service portfolio, and that the detection granularity of Nokia Deepfield allows ESpanix to substantially reduce the impact of DDoS events by isolating and removing only unwanted traffic.

“Crucially, this protection is delivered entirely within our network and within Spain, across the six datacentres in Madrid and Barcelona where we connect with our members,” Achirica said. He added that the arrangement ensures local traffic remains local, eliminating any need for detours through third-party scrubbing infrastructure and thereby guaranteeing strict data sovereignty.

Achirica said unifying the capabilities makes DDoS protection far simpler to implement and operate, and that end users need no specific technical expertise to benefit from the defense. He said the new service enhances the value of connecting to the ESpanix Node and introduces a new dimension to the services ESpanix offers its members.

Jeff Smith, vice president and general manager of Nokia Deepfield, said internet exchanges are critical infrastructure and that, for Spain, ESpanix is where the national internet comes together, which he said also makes it the smartest place to stop DDoS attacks.

“With Deepfield Defender, ESpanix detects and removes attack traffic in seconds, directly in the network and inside the country,” Smith said. He added that the deployment shows how internet exchanges across Europe can turn security into stronger resilience for their members and a new source of value at the same time.

Detection and Mitigation Inside the Network

Nokia said Deepfield Defender combines AI-driven, big data analytics of network telemetry with Deepfield Secure Genome, its proprietary, cloud-based data feed that tracks the security context of the internet. According to the company, Defender detects all types of DDoS attacks in seconds and drives automated, network-based mitigation with a very high degree of granularity, removing only unwanted traffic while legitimate packets keep flowing. By unifying detection and mitigation in the network itself, ESpanix avoids rerouting member traffic to external scrubbing centers: attacks are identified and removed where the traffic flows, Nokia said.

On its website, ESpanix lists more than 200 connected customers, more than 2 Tb/s of switched traffic, 260 Tb/s of installed capacity, and six points of presence in Spain. The exchange describes itself as Spain’s leading IP traffic exchange and one of the largest in southern Europe, and says its team draws on more than 25 years of experience handling IP traffic across the Iberian Peninsula. A single connection to its infrastructure unlocks access to most networks operating across the Iberian Peninsula, ESpanix said, with low latency, high capacity, full redundancy, and end-to-end security. On September 7, 2026, ESpanix announced it had achieved ISO 27001:2022 certification, which it said applies to its interconnection and data centre services.

Partnership History and Service Rollout

The deployment extends a partnership that, in 2025, made ESpanix the first internet exchange point in Spain to offer 400G connectivity to its customers, built on Nokia interconnect and service routers running over Nokia optical transport, according to the release.

Nokia said ESpanix joins a growing group of leading European internet exchanges that use Nokia Deepfield to protect their members and to build new security services on top of their interconnection platforms. For exchanges, the deployment model has a multiplier effect, Nokia said: a single deployment at an exchange extends protection to every network that connects through it.

Nokia said the new DDoS protection service is being introduced to the ESpanix community and the wider industry at upcoming events.