How Fiber Optic Cables Are Made and Laid: From Glass Preform to Street

A fiber optic cable is made by depositing ultra pure silica glass, layer by layer, into a thick rod called a preform, then heating its tip and drawing it into a strand 125 microns across. The strand is coated, proof tested, bundled into tubes or ribbons, jacketed, and then laid in trenches, ducts or on poles, spliced, tested and lit.

Every step leaves a number you can check later: the attenuation the glass promises, the bend radius it tolerates, the loss each splice adds, and the optical budget a home connection must fit. This guide walks the chain, with figures from the ITU-T recommendations that define the fibre and the access networks that use it.

Key takeaways

• Telecom fibre is almost pure silica. A doped core, about 9 microns across in single mode fibre, sits inside 125 microns of cladding with a slightly lower refractive index. Light stays in the core because of that index step.
• Preforms are built by vapour deposition (MCVD, OVD or VAD), because only gas phase chemistry gets metal and water impurities low enough. NTT says the VAD method it invented in 1977 now makes about 60 percent of the world's telecom fibre.
• A preform is heated until a drop of glass falls and is pulled into fibre. Two acrylate coatings bring it to 250 microns. Every metre is proof tested; ITU-T G.657 sets a minimum proof stress of 0.69 GPa.
• ITU-T G.652.D is the standard single mode fibre: cable attenuation at most 0.40 dB per km from 1310 to 1625 nm and 0.30 dB per km across 1530 to 1565 nm. G.657.A fibres meet G.652.D and also bend to 10 mm (A1) or 7.5 mm (A2) radius. G.657.B3 goes to 5 mm.
• Cables group fibres in loose tubes of about 12, or in stacked or rollable 12 fibre ribbons. Armour, aramid yarn and water blocking are added to suit burial, ducts or poles.
• On land, fibre goes into open trenches, ploughed slots, micro trenches cut in the road, ducts it is pulled or blown through, or aerial spans on poles.
• Single mode fusion splices typically lose under 0.05 dB. A loss budget adds fibre, connector and splice losses and compares the total to what the optics can tolerate. An OTDR finds where the loss is.
• GPON sends 2.488 Gbit/s down and up to 2.488 Gbit/s up, splits one fibre 16, 32 or 64 ways, and runs up to 20 km over a 13 to 28 dB class B+ budget. XGS-PON raises both directions to a nominal 10 Gbit/s.
• Fibre can be tapped by anyone with physical access, mainly by bending it so light leaks out. Defenders rely on encryption, locked access points and loss monitoring, not on the glass.

A short timeline of fibre, with dates checked

From raw material to a lit fibre: the whole chain in one table

The rest of this guide takes those steps in order.

How is an ultra pure glass preform made, and why does purity matter so much?

Why purity is the whole game

Glass that you can see through a window looks clear because a few millimetres of it absorb almost nothing. Send light through a kilometre of window glass and none of it comes out. That was the state of fibre in the early 1960s. The Nobel committee's summary of Kao's work puts it plainly: with a fibre of the purest glass, light signals could travel over 100 kilometres, compared with only 20 metres for the fibres of the time.

Kao's insight, presented in January 1966, was that the loss was not a property of glass as such. It came from impurities: traces of metals left in the glass, and water bound into it as hydroxyl. Remove them and the only loss left is the unavoidable scattering from tiny fluctuations in the glass structure. That scattering, called Rayleigh scattering, falls with the fourth power of wavelength, which is why long distance systems work in the infrared, around 1310 and 1550 nm, rather than with visible light.

Hydroxyl is still the impurity that matters most today. It creates an absorption peak near 1383 nm, the so called water peak. Modern G.652.D and G.657.A fibre specifications explicitly cap attenuation at 1383 nm at 0.40 dB per km after a hydrogen ageing test, which means the glass is dry enough that the old water peak no longer blocks that part of the spectrum. The whole range from 1260 to 1625 nm, which ITU-T calls the O, E, S, C and L bands, is usable.

To put those numbers in perspective, 0.30 dB per km means that after 10 km of fibre in the C band, about half the light (3 dB) is left. After 100 km, about 0.1 percent is left, and an optical amplifier or regenerator is needed. Purity buys distance.

Why vapour deposition, and not melting

Melting sand in a crucible, the way ordinary glass is made, cannot reach this purity. The crucible itself contaminates the melt, and the raw sand carries metals. Fibre makers instead start from liquids such as silicon tetrachloride and germanium tetrachloride, which can be distilled to extreme purity, then react their vapours with oxygen in a flame or a heated tube. Metal impurities have very different vapour pressures from the chlorides, so they stay behind. What forms is fine silica soot with exactly the dopant mix the process controller asks for, layer by layer.

Germania raises the refractive index of silica slightly. Putting more of it in the core than in the cladding creates the index step that guides light. Fluorine does the opposite and is used to lower the index of the cladding in some designs. The shape of that index profile, step or graded, sets whether the fibre is single mode or multimode and how it behaves under bending.

The three families: MCVD, OVD and VAD

All three methods start with vapour and end with a solid glass rod that is a scaled up copy of the finished fibre. They differ in where the soot lands.

Modified chemical vapour deposition (MCVD) works inside a hollow tube of high purity silica that rotates on a glass working lathe. Reactant gases flow through the tube while a burner travels along the outside. Each pass deposits a thin layer of soot on the inner wall and sinters it into glass. The first layers become the inner cladding, the last ones the core. When enough layers are built up, the burner heats the tube much hotter and surface tension collapses it into a solid rod. MCVD gives fine control of the index profile and suits specialty fibre, but each tube makes a limited amount of preform.

Outside vapour deposition (OVD) sprays soot from a burner onto the outside of a rotating target rod. Corning, which developed OVD, describes its process in three stages: laydown, consolidation and draw. During laydown the ultra pure materials are deposited as vapour and quality systems monitor each layer. The target rod is removed, and the porous soot body, called a soot preform, is heated in a consolidation furnace until it becomes clear glass and the central hole closes.

Vapour phase axial deposition (VAD) was invented at NTT in 1977 by Tatsuo Izawa, during joint research with Furukawa Electric, Sumitomo Electric and Fujikura that began in 1975. In VAD, glass particles made by flame hydrolysis are deposited on the end of a silica seed rod, and the rod is pulled slowly upward so the porous preform grows lengthwise. The IEEE Milestone citation notes that MCVD and OVD both need a collapsing step to produce a transparent preform, while VAD consolidates the porous glass in a melting zone above the deposition point without collapsing, so preform production can be continuous. NTT's 2015 release says VAD is the most widely used fibre manufacturing method, at about 60 percent of telecom fibre worldwide. An earlier IEEE milestone proposal put the share at more than 50 percent, so the exact figure depends on the year.

Large factories often combine methods, sleeving a precise core rod with cheaper extra cladding glass so one preform yields far more fibre. Most of a fibre's glass is cladding, which needs less index precision than the core.

Consolidation and drying

A porous soot preform is mostly air. In consolidation it is heated in a furnace under drying gases, so that the glass particles fuse and the trapped hydroxyl is driven out. The result is clear and bubble free. This drying step is what took the water peak out of modern fibre. The 1980 NTT reference listed in the IEEE VAD milestone record is titled "Fabrication of Completely OH-Free V.A.D. Fibre", which shows how early that goal was set.

Before drawing, each preform is measured with a preform analyser that maps its refractive index profile. If the profile is off, the preform is scrapped or downgraded before any fibre is drawn.

How is fibre drawn, coated and proof tested?

The draw tower

A draw tower is a vertical line that can stand several storeys high. The preform hangs at the top and its lower end is lowered into a furnace hot enough to soften silica, roughly 2,000 degrees Celsius. A gob of glass forms, falls under gravity, and pulls a thin strand behind it. Operators thread the strand through the line, and from then on a capstan at the bottom sets the draw speed. Faster pulling makes thinner fibre. A laser gauge just below the furnace measures the diameter continuously and adjusts speed to hold the cladding at 125 microns.

G.657 (and G.652, which it mirrors for category A) sets the geometry that the draw has to hit:

The concentricity and diameter tolerances matter for the whole life of the cable. Two fibres meeting in a connector or splice only couple well if their cores line up to within a fraction of a micron, and fusion splicers and connector ferrules reference the outside of the cladding. A fibre drawn off centre loses light at every joint.

Coating

Bare silica is strong, but a single scratch makes it weak. So the fibre is coated before it touches anything. Two layers of acrylate are applied in dies below the gauge and cured instantly by ultraviolet lamps. The inner primary coating is soft, to cushion the glass against small bends that would leak light (microbending). The outer secondary coating is hard, to resist abrasion. The finished coated fibre is usually 250 microns in diameter. High fibre count cables increasingly use fibre with a 200 micron coating, which lets more fibres fit in the same duct.

Proof testing

Every length of fibre is proof tested. The coated fibre runs through a set of pulleys that put it under a fixed tension for a short time. Any flaw big enough to grow into a failure under that load breaks the fibre there and then, in the factory, rather than years later in a manhole. ITU-T G.657 sets the minimum proof stress at 0.69 GPa for both categories A and B, which corresponds to the 100 kpsi level used by much of the industry. The recommendation also notes that the failure probability of fibre held in a tight bend rises as the radius shrinks, so some networks specify higher proof levels for fibre that will live in small bends.

Measuring and colouring

After proof test, each spool is measured. Attenuation is checked at the key wavelengths, often by OTDR or by cutback, along with mode field diameter, cut off wavelength, chromatic dispersion and polarisation mode dispersion. Data go into a record for that spool, so a cable maker can later trace any fibre in a finished cable back to its preform.

Fibres are then coloured. The colour sequence used for 12 fibres in North America is blue, orange, green, brown, slate, white, red, black, yellow, violet, rose and aqua. Tubes and ribbons follow the same sequence, so a splicer in a manhole can identify "tube 3, fibre 7" by colour alone.

Single mode vs multimode, and what do G.652 and G.657 mean?

Modes in plain words

A mode is a pattern in which light can travel along a fibre. A large core, 50 or 62.5 microns, supports many modes. They travel slightly different path lengths, so a short pulse spreads out over distance. That limits multimode fibre to short links: inside buildings and data centres, typically with low cost 850 nm VCSEL lasers. A small core, about 9 microns in single mode fibre, supports only one mode above the cut off wavelength, so there is no modal spreading and the fibre can carry high data rates for tens of kilometres without regeneration.

ITU-T G.652: the workhorse

ITU-T G.652 defines "characteristics of a single-mode optical fibre and cable". The current edition, G.652 (08/24), was approved on 29 August 2024. It has existed in some form since 1988 and has four subcategories, A to D. In practice, almost all new outside plant fibre is G.652.D: low water peak, low polarisation mode dispersion, usable from 1260 to 1625 nm. The headline cable figures, which G.657 category A repeats because it is a subset of G.652.D, are:

Those are specification maxima. Real fibre usually does better: the Fiber Optic Association gives typical single mode figures of about 0.4 dB per km at 1310 nm and 0.25 dB per km at 1550 nm, and many product sheets quote lower still. But a network designer works from the specification, because that is what a contract can enforce.

ITU-T G.657: fibre that tolerates bends

Fibre to the home put fibre into places it had never been: tight corners in apartment risers, staples along skirting boards, small boxes on walls. Standard fibre loses light when bent too tightly; the G.657 text notes that G.652 fibre at a 15 mm radius can lose several dB per 10 turns at 1625 nm. G.657, "characteristics of a bending-loss insensitive single-mode optical fibre and cable", was written for that environment. Its fifth edition was approved on 29 August 2024 and, among other changes, merged the old category B2 into A2.

Category A fibres can go anywhere G.652.D is specified, so many operators now buy G.657.A1 or A2 for all their cable. Category B fibres trade some dispersion and PMD compliance for extreme bend tolerance and are meant for the last few hundred metres inside a building. G.657 is explicit that they are "system compatible" with G.657.A and G.652.D in access networks, which means you can splice them into an access network built of standard fibre.

Multimode grades

Multimode is graded by ISO/IEC and TIA as OM1 to OM5. OM1 is the 62.5 micron fibre that was the data standard from the mid 1980s. OM2 is 50 micron. OM3 and OM4 are 50 micron fibres optimised for 850 nm lasers, with effective modal bandwidths of 1500 and 3500 MHz km respectively at 850 nm. OM5 adds wideband operation from 850 to 950 nm so that several wavelengths can share one fibre. For anything that leaves a building, single mode is the default.

How are fibres built into cables?

A fibre on its own is fragile and tiny. A cable gives it mechanical protection, keeps water out, holds it at the right bend radius, and lets an installer pull it without stretching the glass. There are four families worth knowing.

Tight buffered cable

Inside buildings, each fibre gets a 900 micron plastic buffer over its 250 micron coating. Simplex and zipcord cables add aramid yarn and a jacket around one or two such fibres for patch cords. Distribution cables put several tight buffered fibres under one jacket; breakout cables give each fibre its own jacket and strength member so each can be connectorised directly. Indoor jackets carry flame ratings for riser or plenum spaces.

Loose tube cable

Outside plant cable is usually loose tube. Up to about 12 fibres float loosely in a plastic tube, with slightly more fibre than tube length so that the cable can stretch or shrink with temperature without straining the glass. The tubes are stranded around a central strength member, often a fibreglass rod. Older designs flood the tubes with gel to block water; newer ones use dry water swellable tapes and yarns that expand when wet, which is far cleaner for splicers. Aramid yarn carries pulling tension, and a polyethylene jacket, black for ultraviolet resistance, goes outside. A 144 fibre loose tube cable is a common size.

Ribbon cable

Ribbon cables lay 12 fibres side by side, bonded into a flat ribbon, and stack ribbons inside a central tube or slotted core. This packs the most fibre into the smallest cable, and it lets a mass fusion splicer join all 12 fibres in one operation. Rollable or flexible ribbons bond the fibres only at intervals, so the ribbon can roll into a tight bundle in a tube and still lay flat for mass splicing. Combined with 200 micron fibre, this is how cable makers reach counts of 1,728, 3,456 or 6,912 fibres for metro and data centre routes, and a 1,728 fibre cable can be under 25 mm across.

Armoured, aerial and micro cables

Where rodents chew or rocks crush, a corrugated steel armour layer goes between two jackets. Armour is conductive, so it must be bonded and grounded at closures. Aerial cables are either lashed to a steel messenger wire with a spinning lashing machine, or self supporting with enough aramid to carry their own weight across a span. All dielectric self supporting cable (ADSS) has no metal at all, which suits power line corridors. Some high voltage lines carry fibre inside the earth wire at the top of the towers, called optical ground wire (OPGW).

Micro cables are small, light designs made for blowing into micro ducts: a 144 fibre micro cable can be about 8 mm across, against 15 to 16 mm for a conventional loose tube cable of the same count.

How is fibre laid on land?

The glass and the cable are the cheap part. Labour, civil works and permits make up most of what a fibre build costs, and the choice of installation method drives that cost. Trade groups in the United States now publish studies on how local permitting practice alone changes build costs, which says a lot about where the money goes.

Open trenching and ploughing

The traditional method is an open trench: a narrow excavation, a duct or armoured cable placed in it, a warning tape above, and backfill. It is slow and disruptive in towns but simple in fields. In rural areas, a vibratory or static plough can cut a slot and feed duct or cable into it in one pass, at much higher speed. Directional boring, where a steerable drill head bores a path under a road or river and pulls duct back through it, avoids digging across obstacles.

Micro trenching

Micro trenching cuts a narrow slot in the road or pavement surface with a saw, places micro ducts or a small cable in it, and seals the slot. The ITU-T recommendation on the technique, L.49 (03/2003), says its advantages over conventional laying are speed, lower cost, a much smaller environmental impact and less disruption to roads, which in turn makes permits easier to get. The trade off is depth. A shallow slot is closer to the surface, so future road resurfacing or utility work can damage it, and some road authorities restrict where it is allowed. Good practice is to map micro trenched routes precisely and agree on depths with the road owner.

Ducts, pulling and blowing

Most urban fibre now goes into ducts, because ducts let operators add or replace cable later without digging again. Larger ducts are often subdivided with innerducts, and micro duct bundles hold many small tubes in one sheath.

Cable is either pulled or blown in. When pulling, the rope must attach to the cable's strength members, never to the jacket alone, and the tension must stay within the cable's rating; outside plant cables are typically rated for more than 800 pounds of pull. During pulling a cable should not be bent tighter than about 20 times its diameter, and about 10 times its diameter once installed, unless the maker's datasheet says otherwise. Blowing uses compressed air to float a lightweight cable along a duct while a pusher feeds it in, which puts little tension on the cable and can cover long sections in one go.

Aerial lines

Where poles already exist, aerial deployment is often the fastest and cheapest way to pass homes. Crews either lash cable to an existing steel messenger strand or hang self supporting cable. Aerial plant has its own risks: storms, falling trees, vehicle strikes on poles, and pole attachment rules that require coordination with the pole owner and other attachers. In the United States pole attachment is regulated, and access to poles is a recurring theme in federal broadband policy.

Policy context in the United States

Government money shapes where fibre goes. NTIA's Broadband Equity, Access, and Deployment (BEAD) program is a 42.45 billion dollar federal grant program funded by the Infrastructure Investment and Jobs Act. NTIA's original rules favoured end to end fibre. In June 2025, NTIA's BEAD Restructuring Policy Notice moved the program to a technology neutral approach, returning the definition of "Priority Broadband Project" to the statutory language and removing the separate fibre preference. Fibre still competes for those funds, but alongside other technologies.

How are fibres spliced and terminated, and how is a link tested?

Fusion splicing

To join two fibres permanently, a technician strips the coating, cleans the glass, and cleaves it with a precision cleaver that scores and snaps the fibre to give a flat, perpendicular end. Both fibres go into a fusion splicer, which images the cleaves, rejects bad ones, aligns the cores in two planes, and fuses the ends with an electric arc. The splicer estimates the loss from the images. The joint is protected with a heat shrink sleeve and laid in a splice tray inside a closure.

For single mode fibre, a good fusion splice typically loses less than 0.05 dB. The TIA cabling standard allows up to 0.3 dB per splice for acceptance. Mass fusion splicers join a whole 12 fibre ribbon at once, which is why ribbon cable dominates high count builds.

Mechanical splices hold two cleaved fibres in alignment with index matching gel. They need cheaper tools but cost more per joint and lose more, so they are mostly used for quick restoration and some multimode work.

Connectors and endfaces

Connectors are where fibre networks most often fail, and almost always because of dirt. A connector holds the fibre in a precise ceramic ferrule: 2.5 mm for SC, FC and ST, 1.25 mm for LC and MU. Two ferrules press together in an adapter so the fibre ends touch. The endface polish sets how much light reflects back: a flat physical contact gives about minus 30 to minus 40 dB reflectance, a convex polish minus 40 dB or better, and an angled physical contact (APC) polish at 8 degrees better than minus 60 dB. APC connectors are colour coded green and are the norm in PON networks, because reflections disturb lasers and analogue video overlays. A well made factory connector pair loses typically under 0.3 dB; the TIA limit for a mated pair is 0.75 dB.

The single most useful rule in fibre work is: inspect, clean, inspect again before every connection. A fibre endface microscope shows dust, oil and scratches that cost tenths of a dB each and can permanently damage endfaces when mated.

Loss budgets with worked numbers

A loss budget is a sum. It answers two questions: will this link work with these optics, and what should a test show if it was built correctly?

The method is: fibre length times attenuation per km, plus the number of mated connector pairs times the loss per pair, plus the number of splices times the loss per splice. Compare that total to the power budget of the optics, which is the transmitter's minimum launch power minus the receiver's sensitivity, and leave about 3 dB of margin for ageing and future repairs.

Worked example 1: a 12 km point to point link at 1310 nm.

• Fibre: 12 km at 0.40 dB per km (the G.652.D specification maximum) gives 4.8 dB.
• Connectors: 2 mated pairs at 0.5 dB each gives 1.0 dB.
• Splices: one every 4 km of cable section plus the pigtail splices at each end makes 4 splices at 0.1 dB each, 0.4 dB.
• Total: 6.2 dB expected maximum.

If the optics have a power budget of 15 dB, the margin is 8.8 dB. That is plenty. If the acceptance test measures 9 dB, something is wrong, most likely a dirty connector or a bad splice, even though the link still "works".

Worked example 2: a GPON home connection at 1310 nm upstream.

• Feeder and distribution fibre: 15 km at 0.40 dB per km gives 6.0 dB.
• Splitter: an ideal 1 to 32 power split divides the light 32 ways, which is 10 times log10 of 32, or 15.05 dB. Real splitters add excess loss on top; take the maker's datasheet figure.
• Connectors: 4 mated pairs (OLT patch, cabinet, splitter, home) at 0.5 dB gives 2.0 dB.
• Splices: 8 at 0.1 dB gives 0.8 dB.
• Total before splitter excess loss: about 23.9 dB.

GPON class B+ optics are specified for an optical path loss between 13 and 28 dB, so this link sits inside the budget with about 4 dB of room for splitter excess loss and repairs. Change the split to 1 to 64 and the ideal splitter loss rises to 18.06 dB, the total to about 26.9 dB, and there is now only about 1 dB left. That is the arithmetic behind the common rule that higher split ratios mean shorter reach.

Power meter tests and OTDR

There are two complementary tests.

A light source and power meter test sends a known power in one end and measures what comes out the other. It gives the true end to end loss to compare with the budget. It is quick and cheap but cannot say where a problem is.

An optical time domain reflectometer (OTDR) sends short, powerful pulses into one end and records the faint light that scatters back from every point along the fibre. Because it knows the speed of light in the glass, it turns time into distance. The trace slopes gently downward with fibre attenuation, steps down at splices and bends, and spikes up at reflective events such as connectors and the fibre's far end. Three practical points matter:

• The pulse overloads the receiver for a short distance, the dead zone, so a launch cable is used at the start and a receive cable at the end so the first and last connectors can be measured.
• Two fibres with slightly different backscatter properties make a splice appear as a gain from one direction and an exaggerated loss from the other. Averaging OTDR measurements taken from both ends gives the true splice loss, and it is the only reliable way to test inline splices.
• Averaging many pulses reduces noise. A single pulse trace becomes noisy within a few kilometres; averaging over a thousand pulses keeps it clean far further.

Acceptance records for a new build should include both tests at the wavelengths the service will use, typically 1310 and 1550 nm, and for PON also 1625 or 1650 nm if the operator monitors the plant out of band.

Step by step: plan, verify and monitor a fibre link

This walkthrough assumes you are building or accepting a single mode link, either for a campus, a community network, or a fibre to the home build. The commands are safe and read only.

Step 1: write down the design inputs

Collect: route length (from the as built drawings, plus about 1 percent for excess fibre length inside the cable), number of connectors and splices, fibre type (G.652.D or G.657.A1 or A2), operating wavelengths, and the optics' minimum transmit power and receiver sensitivity from their datasheets.

Step 2: compute the loss budget

A short script keeps the arithmetic honest and repeatable. Save it as budget.py.

import math

def link_loss(km, db_per_km, connectors, db_per_conn, splices, db_per_splice, split=1, splitter_excess=0.0):
    fibre = km * db_per_km
    conn = connectors * db_per_conn
    spl = splices * db_per_splice
    splitter = (10 * math.log10(split) + splitter_excess) if split > 1 else 0.0
    return fibre, conn, spl, splitter, fibre + conn + spl + splitter

def report(name, tx_min_dbm, rx_sens_dbm, **kw):
    f, c, s, sp, total = link_loss(**kw)
    budget = tx_min_dbm - rx_sens_dbm
    print(f"{name}: fibre {f:.2f} dB, connectors {c:.2f} dB, splices {s:.2f} dB, splitter {sp:.2f} dB")
    print(f"  total {total:.2f} dB, optics budget {budget:.2f} dB, margin {budget - total:.2f} dB")

# Example 1: 12 km point to point at 1310 nm, optics with 15 dB budget
report("p2p-12km", tx_min_dbm=-5.0, rx_sens_dbm=-20.0,
       km=12, db_per_km=0.40, connectors=2, db_per_conn=0.5, splices=4, db_per_splice=0.1)

# Example 2: GPON 1:32 at 15 km, budget checked against the 28 dB class B+ ceiling
report("gpon-1x32", tx_min_dbm=0.0, rx_sens_dbm=-28.0,
       km=15, db_per_km=0.40, connectors=4, db_per_conn=0.5, splices=8, db_per_splice=0.1,
       split=32, splitter_excess=1.0)

Run it:

python3 budget.py

The splitter excess loss of 1.0 dB in the second example is a placeholder; replace it with the figure from your splitter's datasheet. If the margin is under about 3 dB, change something now: shorter route, fewer connectors, a lower split ratio, or higher class optics.

Step 3: inspect and clean every connector

Before any test, inspect both endfaces of every connection with a fibre microscope, clean with a dry cleaner or lint free wipe and approved solvent, and inspect again. Never look into a fibre or connector that might be live; the infrared light used in telecom is invisible and can damage the eye. Fit dust caps immediately after inspection.

Step 4: measure end to end loss

With a stabilised light source at one end and a power meter at the other, set a reference using launch and receive reference cords, then measure each fibre at 1310 and 1550 nm. Record the results against the budget. A measured value that beats the budget by a lot is fine. A value worse than budget needs an OTDR trace.

Step 5: take OTDR traces from both ends

Use a launch cable long enough to clear the dead zone, and a receive cable at the far end. Trace each fibre from both directions at the same wavelengths and average the event losses. Save the trace files with the fibre identity (cable, tube, fibre colour) in the filename. These traces are your baseline. When something goes wrong years later, comparing a new trace with the baseline shows exactly where the change is.

Step 6: read optical power from live equipment

Once optics are installed, most modern pluggable modules report their own transmit and receive power through digital diagnostics. On Linux you can read them with ethtool:

# Show module type, wavelength and digital diagnostics, including Tx and Rx power in dBm
sudo ethtool -m eth0

# Narrow it down to the power readings
sudo ethtool -m eth0 | grep -Ei 'wavelength|laser output power|receiver signal'

Compare received power with the receiver's sensitivity and overload limits from the datasheet. Received power near sensitivity means you are close to the edge of the budget. Note the reading on day one, because a slow drop over months is a classic sign of a degrading splice, a bent cable in a closure, or a connector that has picked up dirt.

Step 7: keep an inventory of the passive and active plant

Write down what you built in a machine readable form so that the next person can find it. A minimal record per link looks like this:

link: campus-a-to-b
fibre_type: ITU-T G.657.A1
route_km: 1.82
cable: 48F loose tube, dry, 4 tubes x 12
fibres:
  - id: tube1-blue
    use: primary
    loss_1310_db: 1.21
    loss_1550_db: 0.98
    otdr_trace: traces/campus-a-to-b_t1_blue_1310_A.sor
optics:
  a_end: { form_factor: SFP+, wavelength_nm: 1310, firmware: "record from switch" }
  b_end: { form_factor: SFP+, wavelength_nm: 1310, firmware: "record from switch" }
acceptance_date: 2026-10-24

The optics and the equipment they plug into run firmware and software. Recording versions here is the bridge between physical plant records and the software inventory your security team keeps.

Step 8: set alarms on loss changes

On the switches and the OLT, alert when received power drops by more than a set amount, for example 2 dB from the baseline. A sudden drop on several fibres in one cable points to physical damage. A small drop on one fibre that does not recover may point to a bend or, rarely, a tap. That is the subject of the next section.

How do PON networks bring fibre to homes?

The architecture

Running a separate fibre from the exchange to every home would need enormous cables. A passive optical network shares one fibre among many homes using a passive splitter: a small glass device with no power that divides the light from one input fibre among 16, 32 or 64 outputs. In the operator's building, an optical line terminal (OLT) serves many PON ports. In each home, an optical network terminal (ONT, or ONU in ITU language) terminates the fibre and hands off Ethernet or Wi-Fi.

Downstream, the OLT broadcasts the same light to every home on the splitter; each ONT picks out its own traffic. Upstream, ONTs share the fibre in time: the OLT grants each one time slots, a scheme ITU-T calls time division multiple access, and a dynamic bandwidth assignment process decides who gets how much. Before an ONT can transmit, the OLT measures its distance through a ranging process so that bursts from near and far homes do not collide.

GPON in numbers

ITU-T G.984 is the GPON family. G.984.1 (approved 29 March 2008) gives the general characteristics, G.984.2 the physical layer, and G.984.3 the transmission convergence layer, which covers framing, upstream time division access, dynamic bandwidth assignment, ONU activation, forward error correction and security. The main figures:

XGS-PON and coexistence

ITU-T G.9807.1 defines XGS-PON, a "10-Gigabit-capable symmetric passive optical network". The current version was approved on 22 February 2023, with an amendment in May 2025 that limits out of band noise from ONUs to reduce interference with other systems sharing the same fibre plant. It runs at a nominal 10 Gbit/s in both directions over the same kind of passive network, and it targets homes, businesses and mobile backhaul.

The reason operators can upgrade without digging again is wavelength planning. XGS-PON uses different wavelengths from GPON, so a combiner at the OLT end puts both on the same fibre and each home's ONT only listens to its own technology. Transceivers sold for XGS-PON list 1577 nm downstream and 1270 nm upstream. That is why a well designed GPON build, with G.652.D or G.657.A fibre, APC connectors and a sound loss budget, is also an XGS-PON build waiting for new electronics.

What this means for a home connection

From the street, a home connection is a drop cable from a nearby terminal or splitter, often G.657 fibre because it has to bend round corners, terminated in a small wall box with an APC connector. A patch cord runs to the ONT. When the fibre itself is the problem at home, it is usually a crushed drop, a tight bend behind furniture, or a dirty connector at the wall box.

Physical security of fibre: what can be tapped, from a defender's view

A common belief is that fibre cannot be tapped because it does not radiate like copper. That is only half true. Fibre does not leak electromagnetic signals the way an unshielded copper pair does, but anyone with physical access to the glass can extract light from it.

How taps work, conceptually

The basic physics is the same bend loss that G.657 exists to prevent. When a fibre is bent tightly, some light escapes the core. A tap places a controlled bend on the fibre and collects the escaping light with a detector, leaving most of the signal to continue so the link stays up. Splitting the fibre outright, or splicing in a coupler, are cruder alternatives that briefly interrupt service. Interception at the electronics end, through an unused port on a patch panel or a mirrored switch port, is often easier than tapping the glass at all.

What a defender can see

Every tap removes some light. Published intrusion detection designs note that a simple bend tap typically costs about 1 dB or more, which a monitoring system can see as a step change in received power or as a new event on an OTDR trace compared against the baseline. More careful methods can reduce that signature, so loss monitoring raises the bar but is not proof that nobody is listening.

What the frameworks expect

NIST SP 800-53 control PE-4, "Access Control for Transmission", asks organisations to control physical access to distribution and transmission lines. Its guidance lists locked wiring closets, disconnected or locked spare jacks, protection of cabling by conduit or cable trays, and wiretapping sensors. Control SC-8 covers transmission confidentiality and integrity, and its guidance names two ways to get there: physical protection with a protected distribution system, which it defines as a wireline or fibre optics telecommunications system with adequate electromagnetic, acoustical, electrical and physical controls to carry unencrypted classified information, or logical protection with encryption. For commercial networks, the practical answer is nearly always encryption.

The lesson is simple. Treat every fibre that leaves a room you control as an untrusted medium, encrypt what crosses it, and monitor the plant for loss changes so that a cut or a tap is noticed. The broader picture of how traffic is intercepted on copper, fibre and radio is in our guide on how attackers intercept network traffic.

Where Safeguard fits, honestly

Safeguard does not make, test or monitor fibre. It does not analyse OTDR traces, scan firmware binaries in OLTs or ONTs, or manage network devices, and it has no models for optics or physics. The honest link is the software around the plant. OLT and ONT management systems, fibre planning and GIS tools, test set software, network automation scripts and monitoring stacks are software that operators and integrators build or deploy, and they pull in open source libraries and container images like any other application. Safeguard scans those repositories, container images and SBOM files for known vulnerable components, shows which projects contain a given component and version, and can open fix pull requests when you switch that on. If you run a community network, the companion post on building your own internet as a DIY ISP covers the software and operations side, and how network cards evolved from Ethernet to 800G covers the optics that plug into the fibre.

Common mistakes

• Pulling on the jacket. Attach pulling rope to the strength members only, and stay under the rated tension. A stretched fibre may test fine on day one and fail later.
• Bending past the minimum radius. Twenty times the cable diameter during pulling, ten times once installed, unless the datasheet says otherwise. G.657 fibre tolerates small bends; the cable around it may not.
• Mating a connector without inspecting it. Dirt is the leading cause of high loss and high reflectance. Inspect, clean, inspect.
• Mixing APC and UPC connectors. A green APC connector mated to a blue flat polish connector leaves an air gap and an angled face against a flat one, with high loss and reflection. They are not interchangeable.
• Testing splices from one direction only. Single direction OTDR splice readings can show false gains and exaggerated losses. Test from both ends and average.
• Using the specification maximum as the expected value, or the reverse. Design to the specification so the network is safe, but accept to measured values that reflect real fibre. A link that meets the specification while measuring far worse than its siblings has a fault.
• Skipping the as built records. Without fibre identities, OTDR baselines and splice locations, every future fault starts from zero.
• Assuming fibre is untappable. It is harder to tap than copper, not impossible. Encrypt sensitive traffic and monitor loss.
• Ignoring the software. OLTs, ONTs, switches and management systems run firmware and open source code that need patching. A perfect optical layer does not help if the management plane is exposed.

FAQ

How is fiber optic cable made, step by step?

Purified chemical vapours are turned into glass soot and deposited layer by layer into a preform by MCVD, OVD or VAD. The preform is consolidated into clear glass, drawn into fibre 125 microns across in a draw tower, coated with two acrylate layers to 250 microns, proof tested, measured, coloured, then placed in loose tubes or ribbons and jacketed into cable.

What is a fiber preform?

A preform is a solid glass rod, often several centimetres in diameter and over a metre long, with the same refractive index profile as the finished fibre at a much larger scale. Heating its tip and pulling it out thin turns one preform into many kilometres of fibre.

Why is fibre made of glass and not plastic?

Ultra pure silica has far lower loss at telecom wavelengths. Single mode glass fibre loses about 0.25 to 0.4 dB per km. Plastic optical fibre loses about 1 dB per metre, so it is only used for very short links.

What is the difference between G.652.D and G.657.A2?

Both are single mode fibres with the same transmission properties; G.657.A fibres are a subset of G.652.D. G.657.A2 adds much better bend performance, with a minimum design radius of 7.5 mm, where G.657 notes that plain G.652 fibre can lose several dB per 10 turns at a 15 mm radius, so it suits tight indoor routing and small enclosures.

How deep is fiber optic cable buried?

It depends on the method and the local rules. Conventional trenching and ploughing place cable or duct deeper, below frost and ordinary digging, while micro trenching places it in a shallow slot cut into the road surface. The road or utility owner sets the depth in the permit, so check local requirements rather than relying on a single figure.

How much signal does a fusion splice lose?

A good single mode fusion splice typically loses under 0.05 dB. The TIA acceptance limit is 0.3 dB per splice, and a mated connector pair is allowed up to 0.75 dB.

What does an OTDR test show?

An OTDR shows the loss along a fibre as a function of distance: fibre attenuation as a slope, splices and bends as steps, connectors and breaks as reflective spikes. It locates faults to within metres and gives a baseline for future comparison.

How does one fibre serve many homes in GPON?

A passive splitter divides the light from one fibre among up to 64 homes. Downstream traffic is broadcast to all of them and each ONT takes its own; upstream, the OLT gives each ONT time slots. GPON runs 2.488 Gbit/s downstream over up to 20 km within a 28 dB class B+ budget.

Can fiber optic cables be tapped?

Yes, with physical access. Bending a fibre lets some light escape, and a detector can read it. Each tap usually causes a measurable loss, so power monitoring and OTDR baselines can reveal it, but the reliable defence is encrypting the traffic that crosses fibre you do not physically control.

Is XGS-PON compatible with existing GPON fibre?

Yes. XGS-PON uses different wavelengths, so both can run on the same passive fibre plant at the same time with a coexistence element at the OLT. The upgrade usually means new OLT cards and new ONTs, not new fibre.

Why supply chain hygiene still matters here

A fibre network is glass, but everything that lights and manages it is software: OLT and ONT firmware, switch operating systems, provisioning tools and monitoring stacks, all of which ship open source components that need patching. The physical plant is outside what Safeguard covers, so the section below applies only to the code you build and run around it, where the fit is indirect but real.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

None of these demos touches fibre or optics. They show the software side of running a network: finding and fixing vulnerable components in the tools and services you build, with a person approving each step. To try the CLI, download it from https://safeguard.sh/download and read the setup guide at https://docs.safeguard.sh/docs/cli .

The first demo is a real Safeguard CLI session. Asked to fix the lodash CVE in a repo, it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with approval, prints a summary and pushes nothing, then shows /permissions, /model and /scan. The same flow applies to a provisioning portal or monitoring dashboard your network team maintains. More on the assistant is in the Safeguard CLI as a security aware coding assistant.

Click through it at your own pace, or open it full screen.

The second demo sets up the Safeguard runner on your own machine, approves it with its device code, then scans from the terminal. That suits network tooling that lives on an internal host, such as automation scripts that talk to OLTs and switches, where you want scans to run locally.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use. If your team uses an assistant to answer "which of our services still ship this vulnerable library", this is how it gets read access to that data, with the tool list under your control.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• ITU-T Recommendation G.652, characteristics of a single-mode optical fibre and cable (versions page)
• ITU-T G.652 (08/2024), approval record
• ITU-T Recommendation G.657, bending-loss insensitive single-mode fibre (versions page)
• ITU-T G.657 (08/2024), approval record and full text
• ITU-T G.984.1, GPON general characteristics
• ITU-T G.984.2 (08/2019), GPON physical media dependent layer
• ITU-T G.984.3 (01/2014), GPON transmission convergence layer, summary
• ITU-T G.9807.1, XGS-PON (versions page)
• ITU-T G.9807.1 (02/2023), summary
• ITU-T L.49 (03/2003), micro-trench installation technique, summary
• Nobel Prize in Physics 2009, press release
• Nobel Prize in Physics 2009, popular information
• NTT: VAD method receives IEEE Milestone award (2015)
• ETHW: IEEE Milestone, Vapor-phase Axial Deposition Method, 1977 to 1983
• Corning: Manufacturing excellence in optical fiber
• NIST SP 800-53 Rev. 5 catalog (OSCAL), controls PE-4 and SC-8
• NTIA: Broadband Equity, Access, and Deployment (BEAD) program
• NTIA: Benefit of the Bargain BEAD program announcement
• Fiber Broadband Association: resources
• Fiber Optic Association: optical fiber basics
• Fiber Optic Association: fiber optic cable types
• Fiber Optic Association: splicing and termination
• Fiber Optic Association: loss budgets
• Fiber Optic Association: OTDR testing

Last reviewed: 23 October 2026. Standards editions and grant program rules change; check the linked ITU-T and NTIA pages for the current versions.