Hetzner deploys Nokia Deepfield to bolster DDoS defence

Hetzner has rolled out Nokia's Deepfield Defender across its European data centre infrastructure, expanding distributed denial-of-service (DDoS) protection and pushing mitigation closer to the edge of its network.

The German cloud provider and data centre operator selected the system after testing. The deployment covers Hetzner's European sites and its peering connections, where networks interconnect and exchange traffic.

Nokia's Deepfield Defender combines traffic analytics with automated mitigation. It monitors network telemetry and assesses traffic behaviour in real time, using machine learning models and a threat intelligence feed from Nokia.

Edge Mitigation

The design places mitigation functions on Hetzner's Juniper routers at the network edge, filtering much of the attack traffic before it reaches deeper into the infrastructure. It also reduces the risk of congestion on internal links during high-volume attacks.

For more complex application-layer attacks, Hetzner can divert traffic to Nokia's 7750 Defender Mitigation System. Nokia describes it as a scrubbing platform that cleans traffic and returns legitimate flows to their destination.

The multi-layer setup is designed to keep legitimate customer traffic moving while blocking attack traffic. DDoS attacks can disrupt online services by overwhelming networks, servers, or applications with unwanted traffic. Cloud platforms and shared infrastructure can be attractive targets because a single incident can affect multiple customers.

Hetzner Head of Network Martin Fritzsche said the decision balances a fast attack response with the protection of legitimate customer traffic.

"It was crucial for us to find a solution that reliably detects attacks and stops them early in the network without affecting our customers' legitimate traffic."

"With Nokia Deepfield Defender, we can automatically and accurately defend against DDoS attacks while maintaining full control over traffic in our own infrastructure," Fritzsche said.

Telemetry And Threat Intel

Deepfield Defender analyses traffic patterns and identifies attack characteristics using network telemetry. Nokia links that telemetry with its Deepfield Secure Genome Threat Intelligence Feed, which it says tracks the security context of more than five billion IP addresses worldwide.

Nokia positions the approach as more flexible than threshold-based DDoS systems, which often rely on static baselines and preset traffic limits. It also describes Deepfield Defender as "zero-touch automation", reducing the need for operators to maintain extensive threshold lists or manually create traffic baselines. Nokia says its machine learning models adapt to network conditions and emerging attack methods.

Deepfield Defender uses industry standards for network control and signalling. Hetzner said it supports edge mitigation across multiple router platforms via protocols such as BGP Flowspec and NetConf, which can help operators running multi-vendor networks apply consistent mitigation policies across different hardware platforms.

European Context

Hetzner's European footprint includes data centres in Nuremberg and Falkenstein in Germany, and Helsinki in Finland. The company also has infrastructure in Singapore and the United States. This deployment focuses on Hetzner's European data centre infrastructure.

The project builds on earlier work between the two companies. Hetzner recently upgraded data centres and core network infrastructure with Nokia 7750 SR-1x routing technology, according to the statement.

Hetzner said performing mitigation within its own network supports data sovereignty requirements, and tied the approach to European data protection expectations and its ISO 27001 certification. In-network mitigation can also reduce the need to send traffic to external scrubbing providers, which some customers view as a compliance and privacy issue.

AI Workloads

The rollout comes as cloud operators face rising demand from AI-related workloads, which can drive higher network utilisation and increase the operational impact of service disruptions. Hetzner pointed to GPU servers, high-performance computing clusters, and cloud resources used for AI applications across Europe.

Nokia Vice President for Network Infrastructure Europe, Matthieu Bourguignon, said the threat landscape is changing and that providers need more automated tools to respond at the network edge.

"Cyber attacks are getting more advanced which means the tools we use to fight it need to as well. Deepfield Defender's AI-powered analytics, comprehensive network telemetry and global threat intelligence allows Hetzner to stop attacks autonomously at the network edge, as well as analyzing and purging more complex threats."

"Hetzner's customers will be reassured that with this security investment their data will be even more protected and their services assured," Bourguignon said.

Hetzner said the architecture leaves room for future expansion as traffic volumes and attack patterns evolve across its European network.