ESpanix Shield

ESpanix Shield is DDoS protection built into the exchange: we detect and block the attack inside the ESpanix network, before it reaches your port. No diversions, no added latency.

• No added latency: legitimate traffic travels straight through. The path under attack is the same as the path in calm conditions: no GRE tunnels, no extra hops.
• Certified sovereignty and security: mitigation happens inside the ESpanix network, certified to ISO/IEC 27001 and to the Spanish National Security Framework (ENS) at High category. Your traffic never leaves Spain.
• Precision: granular filtering that separates attack sources from the real user arriving over the same network, without discarding whole prefixes.
• Protection in both directions: we also identify attack traffic leaving your network, keeping your infrastructure out of global campaigns.

The traditional solution consists of detecting the attack, diverting traffic to an external scrubbing centre via BGP/GRE and reinjecting it clean. In the context of an Internet Exchange Point (IXP), this model has three critical flaws:

1. Tromboning and Latency: By diverting traffic, you introduce a round trip outside the optimal route. For low-latency services (online gaming, high-frequency trading, VoIP), this is unacceptable.
2. Loss of Sovereignty: Your sensitive traffic travels through third-party infrastructures, often outside the EU, creating operational dependencies and regulatory compliance risks (GDPR, ENS) that corporate clients and public administrations cannot tolerate.
3. Geographic Inefficiency: An attack launched from Spain, targeting Spain, must leave and re-enter via international links or backbone to be cleaned. It is a waste of network resources.

For Network Operators and ISPs (Access Networks)

Your access networks are the potential source of millions of compromised IoT devices. Failing to filter malicious traffic before it enters the IXP has two negative effects:

1. Operational Cost: You spend outgoing bandwidth attacking others, paying for traffic that generates no revenue.
2. Reputational and Technical Damage: If your network becomes a source of attacks saturating other members, you face complaints, disconnections, or peering restrictions. ESpanix Shield helps you stop the bleed before it pollutes the node.

For Enterprises and Service Providers (Traffic Consumers)

If you contract capacity at ESpanix to distribute content or services:

• Real Availability: You avoid having low-volume but high-intensity attacks (L7 or SYN flood) take down your servers.
• Quality of Experience (QoE): By not suffering the added latency of scrubbing, your end users maintain service fluidity even under attack.
• Resilience: Protection scales with your contracted bandwidth. You do not need to buy “extra cleaning” if the attack exceeds your normal thresholds; filtering in silicon supports line rates.

In today’s European regulatory environment, data residency matters as much as availability.

• National jurisdiction. ESpanix Shield operates within the ESpanix network in Spain. Traffic does not leave the country to be processed or cleaned, and it does not pass through third-party platforms.
• Certification. The infrastructure delivering the service is certified to ISO/IEC 27001 and complies with the Spanish National Security Framework (ENS) at High category. At ESpanix we certify the whole organisation, not a single service line.
• Transparency. You can show your customers and your auditors that mitigation happens under national operational control, in line with CCN-CERT guidance and with the digital sovereignty requirements of public administrations.