Metropolitan Area Networks Explained: Metro Ethernet and Dark Fibre for Network+

A metropolitan area network spans a city or a large campus — bigger than a LAN, smaller than a WAN. For the broader network-type hierarchy and how WANs work, see WAN Explained. This article is about what makes the metropolitan scale distinctive.

A MAN is the awkward middle: too large for you to own all the cable, too small to need carrier WAN services. That tension defines everything about how one gets built.

Where the Boundaries Fall

Typical reach is roughly 5 to 50 kilometres — a city, a metropolitan region, or a set of campuses within one urban area. Beyond that you are into WAN territory; below it, a campus area network.

The distinction is not purely about distance, though. A MAN is characterized by being within one metropolitan area, which usually means one regional carrier can serve all the sites, latency stays low enough for synchronous applications, and dedicated fibre is economically plausible in a way it is not across a continent.

Who Actually Builds Them

Municipalities connecting council offices, libraries, schools, traffic systems and emergency services — often with their own fibre, laid once and owned outright.

Universities and hospital systems linking buildings across a city.

Carriers selling Metro Ethernet services to businesses with several sites in one city.

Enterprises connecting a head office to a nearby data centre, where the latency matters enough to justify a dedicated link.

The Technologies

Metro Ethernet is the dominant answer today. The carrier delivers a standard Ethernet handoff at each site, and the network behaves like one large switched LAN spanning the city. The Metro Ethernet Forum defines the service types, and the two to know are E-Line, a point-to-point connection between two sites, and E-LAN, a multipoint service where every site can reach every other. E-Tree adds a hub-and-spoke variant.

The appeal is operational: no new protocols, no CSU/DSU, no encapsulation to think about. It is an Ethernet port, and your existing switching knowledge applies.

Dark fibre is unlit fibre leased from a provider or municipality, with the customer supplying the optics at each end. It gives complete control over capacity and protocol, and it is the option that makes sense when you need very high bandwidth continuously.

DWDM and CWDM — wavelength division multiplexing — carry many independent channels over one fibre pair by using different wavelengths of light. DWDM packs channels densely and is what makes a single dark fibre pair carry enormous aggregate capacity. This technology is closely associated with the metro scale.

SONET/SDH ring topologies were the traditional metro backbone, with sub-50-millisecond protection switching if the ring broke. Largely legacy now, displaced by Ethernet, but still named in exam objectives.

Older technologies that appear in objective lists for historical reasons: FDDI and DQDB.

Why the Metro Scale Is Distinctive

Three properties follow from the geography and are worth understanding rather than memorizing.

Latency is genuinely low. Round trips across a metropolitan area are typically well under 5 milliseconds, which is what makes synchronous replication between a primary site and a nearby data centre viable. Over a true WAN it usually is not — the speed of light stops being negligible. This is the technical reason disaster recovery sites are often placed at metro distance: close enough for synchronous replication, far enough to survive a local event.

Fibre ownership is plausible. Laying or leasing dark fibre across a city is expensive but finite. Across a country it is not an option for most organizations.

Redundancy usually means ring topologies, because a ring provides two paths to every node with far less fibre than a mesh.

Security

The important point: Metro Ethernet and dark fibre are not encrypted. A carrier-provided Ethernet service carries your frames across infrastructure you do not control, and fibre can be tapped — bending a cable enough to leak light is a demonstrated technique that does not interrupt the link.

For sensitive traffic, MACsec provides layer 2 encryption on Ethernet links and is the natural fit for Metro Ethernet, while IPsec works at layer 3. Treating a metro link as trusted because it is "private" is the mistake to avoid.

Network+ (N10-009) Exam Tips

• A MAN spans a city; larger than a campus network, smaller than a WAN.
• Metro Ethernet is the current dominant technology, with E-Line and E-LAN as the service types.
• Know dark fibre, DWDM/CWDM, and SONET/SDH rings.
• Low latency enables synchronous replication, which is why DR sites sit at metro distance.
• It is not encrypted by default — MACsec or IPsec is required.
• Know the full hierarchy: PAN, LAN, WLAN, CAN, MAN, WAN, and SAN as the odd one out.

Key Takeaways

• A MAN covers a city, roughly 5 to 50 km, between campus and wide area scale.
• Metro Ethernet dominates, delivering a familiar Ethernet handoff with E-Line and E-LAN services.
• Dark fibre with DWDM is the option when you want control and capacity.
• Sub-5-millisecond latency makes synchronous replication possible, which WAN distances do not.
• SONET/SDH rings are the legacy backbone still named in objectives.
• Nothing about a metro link is encrypted — add MACsec or IPsec.