How fibre broadband actually reaches a building
Every IP address anyone ever looks up, whether it’s a fraud team scoring a login or a proxy buyer checking what they’re paying for, ends somewhere physical. Not in a cloud, not in an abstraction. In a strand of glass running into a real building on a real street. Understanding how fibre actually gets there explains a lot about why IP addresses behave the way they do, why some are trusted and some aren’t, and why the last few hundred metres of a network are the part that everyone in the adversarial infrastructure world cares about most.
From the ocean to the exchange
Long before fibre reaches a neighbourhood, it’s already travelled a long way. International traffic mostly moves over subsea cables, bundles of glass fibre pairs running along the seabed between continents, landing at stations that hand traffic off to national backbone networks. From there it moves through a hierarchy of exchanges: national core sites, regional hubs, and eventually a local exchange that serves a specific area.
At that local exchange sits a piece of equipment called an OLT, an optical line terminal. This is where an ISP’s network stops being abstract and starts being a physical, addressable thing pointed at a neighbourhood. The OLT is the origin point for everything downstream of it, and it’s also the point where an ISP can see, in aggregate, every subscriber connected through that exchange. This matters later, because IP reputation and geolocation databases are built largely from exactly this kind of allocation data: which ISP owns which block, and roughly which exchange or region that block serves.
Splitting the signal: how PON gets fibre to a street
Running an individual fibre strand all the way from the exchange to every single home would be extraordinarily expensive. Almost no residential fibre network works that way. Instead, most fixed-line fibre deployments use a passive optical network, PON, where a single fibre leaving the OLT is split, using a passive optical splitter with no power supply of its own, into many downstream fibres. A typical GPON split ratio is 1:32 or 1:64, meaning one strand of light leaving the exchange can end up serving thirty two or sixty four separate premises.
That splitter usually lives in a street cabinet or an underground chamber, not inside the exchange itself. It’s a completely passive piece of glass and coating, no electronics, no software, which is part of why fibre networks are relatively cheap to maintain once they’re built. From the splitter, individual fibre strands run out to each subscriber’s building. The OLT talks to every ONT behind a given splitter using time division multiplexing, taking turns on the shared fibre so that thirty two households can all use what looks, from their side, like a dedicated line.
FTTP versus FTTC: where copper still sneaks in
Not every connection marketed as “fibre broadband” actually runs fibre into the building. There are two very different architectures that both get called fibre, and the difference matters for anyone trying to understand what’s actually happening on the wire.
Fibre to the premises, FTTP, is what most people picture: the optical fibre itself runs all the way from the splitter to a small terminal on an external or internal wall of the building. Fibre to the cabinet, FTTC, stops the fibre at a street cabinet and finishes the last stretch to the building over the existing copper telephone line, usually using VDSL. FTTC is cheaper to deploy because it reuses copper that’s already in the ground, but that final copper run is distance sensitive. Speeds drop off the further a building sits from the cabinet, which is why two houses on the same street, on the same FTTC cabinet, can report noticeably different broadband speeds depending on how much copper separates them from the fibre. FTTP doesn’t have that problem, because there’s no copper left in the path at all.
The last stretch: drop cables, ONTs and the box on the wall
Whichever architecture is used, the final physical piece is the same idea: a drop cable, a thin fibre or copper run, connects the street infrastructure to a small box mounted inside or outside the building. On an FTTP connection this box is the ONT, the optical network terminal, which does the actual conversion from light pulses to an electrical signal. The ONT is where “the network” stops being a telecom company’s infrastructure and starts being equipment the subscriber is responsible for.
From the ONT, an Ethernet cable typically runs to the subscriber’s router, which is the device actually handling Wi-Fi, DHCP for the local network, and the connection to the ISP. Some ISPs combine the ONT and router into a single box, others keep them separate. Either way, this is the last hop before traffic from a device inside the building actually leaves onto the public internet, and it’s the point where the building’s physical location and the ISP’s allocated address space converge into a single identity: a subscriber line.
Getting an address: DHCP, PPPoE and why an IP isn’t really “yours”
Once the physical path is in place, the router still has to be handed an IP address, and how that happens shapes a lot of what makes an IP address trustworthy or not from the outside.
Many ISPs authenticate a subscriber’s connection using PPPoE, a protocol that wraps a login exchange around the physical link before an IP address is assigned. Others assign addresses more simply over DHCP once the physical line is recognised as active. Either way, the address handed to a subscriber almost always comes from a block the ISP owns and has registered with a regional internet registry. That registration is public. It’s exactly what lets IP geolocation and reputation services map an address back to an ISP, a rough region, and a connection type, without ever touching the subscriber’s traffic.
Most residential connections get a dynamic address that can change on reconnection, or sit behind carrier grade NAT, CGNAT, where many subscribers share a single public IP and the ISP tracks who’s using which port range internally. Static IPs exist but are the exception on residential lines, usually reserved for business connections. This is part of why residential IP space behaves so differently from datacentre IP space when it’s evaluated by a fraud or bot detection system: a residential address sits behind a real physical PON split, a real ONT, a real subscriber account with an ISP, and its history of use is tied to actual homes cycling through DHCP leases, not a server rack. That physical grounding is exactly why residential IP addresses carry more inherent trust than datacentre ranges, and exactly why anyone building detection systems watches for signals, like impossible round trip times or ASN and behaviour mismatches, that suggest an address claiming to be a home connection isn’t actually terminating in one.
Why the physical path matters to anyone reading an IP address
None of this is abstract for people working on the adversarial side of the internet, whether they’re building detection or trying to understand what a proxy provider is actually selling. Every IP reputation score, every “this login looks like it’s from a datacentre” flag, every geolocation lookup, ultimately rests on the fact that real internet connections have a real physical shape: a splitter serving thirty two households, an ONT bolted to a wall, a subscriber account tied to an ISP that reports its address allocations to a registry. That physical reality is what makes an address behave consistently over time, and it’s exactly the property that gets scrutinised whenever something is trying too hard to look like it.
Fibre isn’t a metaphor for “fast internet”. It’s a specific, physical, splittable, distance limited piece of infrastructure, and understanding its shape is a genuinely useful starting point for understanding everything built on top of it, cat included, mouse included.
Curious how the rest of this machinery works, from the addresses fibre hands out to the systems built to tell real connections from fake ones? Explore more on The Hidden Internet.
Get new guides and videos first — join the Telegram channel.