How fibre internet actually works
A strand of glass thinner than a hair runs from a cabinet in your street to a box on your wall, and light bounces along it without ever escaping. Nothing in the path is electrical until the last few metres — and the reason your connection is fast has less to do with the glass than with what the operator decided to share.
Most 'fibre' was never fibre to your house
The single most confusing thing about fibre broadband is that the word has been used to sell two completely different products. Knowing which one arrives at your building explains almost everything about the speed you get.
Why the copper matters so much
Copper was designed to carry a voice call — a few thousand hertz. Getting tens of megabits through it means using frequencies far above anything it was built for, and those high frequencies fade quickly. The signal weakens with every metre, and the pairs in a bundle interfere with one another, which is why your neighbour getting an upgrade can genuinely slow you down.
Glass has none of these problems at household distances. A signal that would be unusable after 300 metres of copper is still perfectly readable after 20 kilometres of fibre. That is the entire difference, and it is why FTTP speeds are quoted as a flat number while FTTC speeds are always an estimate.
| Name | What it means | Last leg to you |
|---|---|---|
| FTTP / FTTH | Fibre to the premises / home | Glass, all the way |
| FTTC | Fibre to the cabinet | Copper, 100–500 m |
| FTTB | Fibre to the building | Copper or ethernet inside the block |
| G.fast | FTTC with a wider frequency range | Copper, but only ~100 m |
| HFC / cable | Hybrid fibre-coax | Coaxial cable, shared locally |
| Full fibre | Marketing term for FTTP | Glass, all the way |
The takeaway Fibre to the cabinet is copper broadband with a shorter copper run. Fibre to the premises is a different technology that happens to be sold under a similar name.
Why the light never leaks out
A fibre is a thread of extremely pure glass, and the light travelling along it does not simply shine down the middle. It bounces, thousands of times per metre, off a boundary that it can physically never cross.
The strand has two layers of glass, not one. The core in the middle carries the light. The cladding around it is made of glass with a slightly lower refractive index — light travels marginally faster in it. That tiny difference is the whole trick.
Total internal reflection
When light inside a denser material strikes a boundary with a less dense one at a shallow enough angle, it does not refract out — it reflects entirely back in. Not mostly; entirely. This is total internal reflection, and it is the same effect that makes the underside of a swimming pool surface look like a mirror when you are below it.
Because the fibre is manufactured so that light entering it always strikes the core- cladding boundary at a shallow angle, every ray is permanently trapped. It can go round a bend, over a hill and under a road, and it still cannot escape sideways. Only a sharp enough bend — sharper than the cable will normally allow — can make the angle steep enough for light to leak.
Single mode and multi-mode
Single-mode
A core so narrow (around 9 µm) that light can only take one path down it. Nothing spreads out, so the signal survives tens of kilometres. This is what runs to your house.
Multi-mode
A wider core (50–62.5 µm) where light takes many paths at once. Cheaper transmitters, but the paths have different lengths, so pulses smear together after a few hundred metres.
The purity of the glass is genuinely extraordinary. If seawater were as transparent as fibre-optic glass, you could see the bottom of the deepest ocean trench from the surface. That purity is what lets a signal travel 20 km and still be readable, and it is why fibre was a materials-science problem long before it was a networking one.
The takeaway Light is trapped in the core by a boundary it cannot cross at a shallow angle. The glass is pure enough that a pulse can travel tens of kilometres and still be understood.
Your fibre is shared, and that is the point
There is not a dedicated strand of glass running from your house to the exchange. Running one per property would be ruinously expensive, so the operator runs a single fibre out and splits it — passively, with no electronics and no power — among a group of homes.
This arrangement is called a passive optical network, and the current common form of it is GPON. A single fibre leaves the exchange, travels to your area, and meets an optical splitter in a street cabinet or a joint box. That splitter divides the light among typically 32 properties, sometimes 64.
Downstream and upstream work differently
Going out to the homes, the exchange simply broadcasts everything to everyone on the splitter. Each ONT receives all of it and discards the frames not addressed to it — which is why the traffic is encrypted, since physically every neighbour's ONT can hear your data arriving.
Coming back is harder, because 32 homes sharing one fibre cannot all transmit at once; their light would collide and be unreadable. So the exchange hands out transmission slots, telling each ONT precisely when it may send and for how long. Your upload is scheduled, microsecond by microsecond, by equipment in the exchange.
Different colours, same glass
Downstream and upstream do not take turns on one wavelength — they use different ones, so both can occupy the same fibre simultaneously without interfering. Light of different wavelengths passes through the same glass completely independently.
| Direction | Wavelength | Notes |
|---|---|---|
| Downstream (to you) | 1490 nm | Broadcast to every ONT on the splitter |
| Upstream (from you) | 1310 nm | Scheduled in time slots by the exchange |
| Legacy RF video | 1550 nm | Used by some operators for TV overlay |
| XGS-PON down | 1577 nm | Coexists with GPON on the same fibre |
| XGS-PON up | 1270 nm | Lets operators upgrade without re-cabling |
This is why an operator can upgrade a whole area from 2.5 Gbps GPON to 10 Gbps XGS- PON without digging anything up. The new service uses different colours of light on the same glass, and the two run side by side while customers are migrated.
The takeaway One fibre serves a few dozen homes through an unpowered glass splitter. Your download is broadcast to everyone and filtered; your upload gets scheduled slots. Different wavelengths keep the two directions apart.
The two boxes on your wall, and what each one does
An FTTP installation leaves you with two separate devices, and almost everyone treats them as one thing called 'the internet box'. They do entirely different jobs, and knowing which is which turns most fault-finding into a two-minute exercise.
The ONT
Optical Network Terminal. Where the glass ends. It converts light into electrical ethernet signals and back, and belongs to the network operator. It has no idea what the internet is.
The router
Yours, or supplied by your provider. It logs in to the provider, hands out addresses to your devices, runs the Wi-Fi and the firewall, and decides what goes where.
Why they are separate at all
The ONT is a piece of the operator's network that happens to live in your house. It is registered to your line, it is managed remotely by the exchange, and it is deliberately dumb: it terminates the optical link and presents an ethernet port. Keeping it separate means you can replace your router with a better one without touching anything the operator cares about.
Some providers supply a combined unit with the ONT built into the router. It is tidier, but it means switching to your own router is either impossible or requires the provider to send a separate ONT.
What the router adds
- Authentication. It logs in to the provider, proving the line belongs to a paying customer — this is the PPPoE step in the next section.
- Address translation. You get one public address; every device in the house needs one. The router maps between them.
- DHCP. It hands out private addresses to your phones, laptops and everything else so none of them collide.
- Firewalling. Unsolicited traffic from outside is dropped by default, which is why your devices are not directly reachable from the internet.
- Wi-Fi. Entirely separate from the fibre, and by far the most common reason a fast connection feels slow.
The takeaway The ONT turns light into ethernet and nothing else. Everything you think of as 'the internet working' — logins, addresses, Wi-Fi, blocking — is the router's job.
Proving the line belongs to a customer
A working fibre link is not the same as a working internet connection. The glass is lit and the ONT is registered, but nothing knows who you are or whether you have paid. That is settled by a login — one that happens automatically, every time, in a few hundred milliseconds.
Most providers use PPPoE, Point-to-Point Protocol over Ethernet. The name is a historical accident: PPP was designed for dial-up modems, and when broadband arrived the industry kept the part that handled logging in and billing, and wrapped it inside ethernet frames.
Why a login at all
The provider needs to know which account is using the line, so it can apply the right speed profile, count the traffic, apply any parental filtering you asked for, and stop serving you if you stop paying. A physical connection alone tells it none of that — someone could move house and inherit a working line.
It also gives a clean place to hang the session. Everything about your connection — your public IP address, your speed tier, your traffic — is attached to a PPPoE session that can be torn down and rebuilt in seconds. When a support agent asks you to reboot the router, they are usually just forcing a fresh session.
The alternative: DHCP instead
Some providers, particularly newer full-fibre networks, skip PPPoE and identify you by which port on which piece of equipment your fibre terminates on. Your router then simply asks for an address with DHCP, exactly as a laptop does on a home network. It is simpler and slightly faster to establish; it just requires the operator's records to be accurate.
| PPPoE | DHCP / IPoE | |
|---|---|---|
| How you are identified | Username and password | The physical port you are on |
| Changing provider | New credentials in the router | Operator reconfigures the port |
| Overhead | 8 bytes per packet (MTU 1492) | None (MTU 1500) |
| Session concept | Explicit, can be reset | Implicit |
| Common with | Openreach-based UK providers | Many alt-nets and cable |
The MTU detail that causes strange bugs
PPPoE adds 8 bytes of its own to every packet, so the largest packet that fits drops from 1500 bytes to 1492. Almost everything handles this automatically. When something does not — usually a badly configured VPN or firewall — the symptom is peculiar and memorable: small requests work perfectly, and anything large hangs forever. Pages half-load; file transfers stall at the same point every time.
The takeaway PPPoE is a login inherited from dial-up that still decides whose connection this is. It attaches your identity, your speed tier and your public address to a session that can be rebuilt in seconds.
Addresses: one for the house, many for the devices
Once authenticated, your router is given an IP address — usually exactly one. Behind it sit a dozen or more devices that all need to be addressable. The arrangement that resolves this is so universal it is invisible, and it shapes what you can and cannot do with your connection.
The internet ran out of IPv4 addresses years ago. There are about 4.3 billion of them, which was ample in 1981 and absurd now. The stopgap that has held the whole thing together is NAT — Network Address Translation.
What NAT quietly breaks
NAT works beautifully for connections you start and awkwardly for connections someone else starts. If a device outside tries to reach your laptop, the router receives the packet, finds no matching entry in its table, and drops it — it has no way of knowing which of your devices was meant. This is why hosting a game server or a camera needs port forwarding: you are manually adding an entry to that table.
CGNAT: when you do not even get one public address
Some providers, especially mobile and newer fixed operators, have run so short of addresses that they apply NAT a second time in their own network. You are given a private address, and hundreds of customers share one public address between them. This is carrier-grade NAT.
Most people never notice. If you do notice, it is because something stopped working that used to: port forwarding has no effect, remote access to home cameras fails, some peer-to-peer connections struggle, and occasionally a website blocks you because a stranger sharing your public address misbehaved. Providers will usually move you off CGNAT on request, sometimes for a fee.
IPv6 is the actual fix
IPv6 has enough addresses that every device on Earth can have a globally unique one with room to spare — the address space is large enough to assign several to every grain of sand. With IPv6 there is no NAT and no sharing; your laptop has a real address of its own, and the firewall, not the address shortage, is what keeps it private.
Most UK fibre providers now hand out IPv6 alongside IPv4, and your devices quietly prefer it when both are available. A meaningful share of your traffic is probably already using it without you having configured anything.
The takeaway You get one public address and share it across the house with NAT. If your provider is short of addresses they may share that one further still, which is invisible until the day you try to host something.
Why it is slower than the number you were sold
Fibre removed the bottleneck that used to dominate — the copper. What it did not do is make everything else disappear. When a gigabit line feels slow, the fibre is almost never the reason.
The first suspect is nearly always Wi-Fi
A gigabit connection arriving at a router that then delivers it over a congested 2.4 GHz channel through two brick walls is a gigabit connection you will never see. Wi- Fi is a shared, half-duplex medium contending with every neighbouring network; fibre is a dedicated, full-duplex link. Testing over Wi-Fi tells you about your Wi-Fi, which is a different topic with its own guide.
The simplest diagnostic in home networking: plug a laptop into the router with a cable and run the same test. If the wire is fast and the Wi-Fi is not, no amount of arguing with your provider will help.
Contention on the shared segment
The splitter shares capacity among a few dozen homes and the operator's backhaul is shared much more widely than that. Networks are deliberately built on the assumption that not everyone uses their full speed at once, because building for that would be wildly uneconomic. In the evening peak, more people are using it at once.
| Bottleneck | How to recognise it |
|---|---|
| Wi-Fi | Fast on a cable, slow wirelessly; varies by room |
| Evening contention | Fast at 3am, slower at 8pm, every day |
| The remote server | One site slow, everything else fine |
| Single-stream limits | One download slow, several at once saturate the line |
| Old router | Line speed exceeds what the router can actually route |
| The device itself | An old phone or laptop that cannot go faster |
A single download rarely fills a fast line
One TCP connection to a distant server is limited by round-trip time and the server's willingness to send. On a 900 Mbps line, a single download from an overseas server might reach 80 Mbps and be behaving perfectly correctly. Speed tests open many connections at once specifically to get around this — which is why a speed test can report 900 Mbps while a real download sits at a tenth of that.
Upload matters more than the marketing suggests
FTTC gave you perhaps 20 Mbps up against 70 down, and for browsing that is fine. It stops being fine the moment you are on a video call, backing up photos, or sharing your screen — all of which are upstream. Many FTTP packages are still asymmetric, and the symmetric options are worth the difference if anyone in the house works from home.
The takeaway The glass is almost never the limit. Wi-Fi, evening contention, single-stream behaviour and the far end account for nearly every disappointing speed test.
Putting it together: one click, end to end
Every piece has been covered separately. Here is the whole sequence in order, from a link you tap to a page appearing — with the parts people usually get wrong called out as they go past.
- Your laptop already holds a private address such as 192.168.1.42, handed to it by the router's DHCP server when it joined the network.
- It needs the site's address, so it asks a DNS resolver to turn the name into an IP address. That query itself travels the whole path below, first.
- The request leaves over Wi-Fi or ethernet and reaches the router, which rewrites the source address to its own public one and notes the swap in its NAT table.
- The router sends it inside the PPPoE session established when it booted, wrapped in ethernet frames, out of its WAN port to the ONT.
- The ONT converts the electrical signal into pulses of 1310 nm light, and transmits only during the slot the exchange allocated it.
- The light travels up the fibre, through the passive splitter — which combines it with the other homes' upstream light — and on to the exchange.
- The OLT there converts it back to electrical signals, checks the session is a paying customer, applies the speed profile, and hands it to the provider's network.
- It crosses the provider's backbone, probably an internet exchange, and arrives at the server. The reply retraces the path, arriving on 1490 nm light, broadcast to every ONT on your splitter and ignored by all but yours.
- Your router looks up the NAT table, sees the conversation belongs to the laptop, rewrites the destination address and forwards it.
On a UK connection to a UK server, the whole round trip is typically 10 to 15 milliseconds. A good deal of that is not distance but the scheduling — the ONT waiting for its allocated slot, and the equipment at each end processing frames.
Which part is which when something breaks
| Symptom | Where to look |
|---|---|
| No lights on the ONT at all | Power, or a genuine line fault — call the provider |
| ONT fine, router says no internet | PPPoE credentials or a provider-side fault |
| Internet works, one site does not | DNS, or that site — not your connection |
| Fast wired, slow wireless | Wi-Fi: channel, band, distance, interference |
| Slow only in the evening | Contention — normal, unless it is severe |
| Large transfers hang, small ones fine | MTU, usually a VPN or firewall misconfiguration |
The takeaway Eight steps, total internal reflection, a splitter shared thirty-two ways and a login inherited from dial-up modems — and when it feels slow, it is overwhelmingly likely to be the Wi-Fi in the last five metres.