What Is a Metropolitan Area Network (MAN)? Explained Simply

How a MAN connects sites across a city, how it compares to LAN, CAN and WAN, what a metro link really costs in latency, and when SD-WAN is the better buy.

By Tudor Uzun

Founder and Senior Software Engineer, IP Trackers

Published April 4, 2026Updated August 26, 2026Editorial standards

A metropolitan area network (MAN) sits between a local area network and a wide area network in both size and purpose. It connects buildings, campuses, and offices across a city — typically spanning 5 to 50 kilometers — using high-speed fiber optic links. If a LAN is one building and a WAN is the entire internet, a MAN is the city-scale layer that stitches local networks together.

Why Metropolitan Area Networks Exist

The gap between LANs and WANs created a real problem. Organizations with multiple locations in the same city — hospitals, universities, government agencies — needed to share data faster than a WAN could deliver, but across distances too large for a single LAN. The public telephone network was never designed for heavy data traffic, so it could not fill this gap either.

The breakthrough came in the mid-1990s when single-mode optical fiber became practical for inter-building connections. Suddenly, organizations could link their separate LANs at speeds that rivaled internal network performance. The metropolitan area network was born out of this capability — a dedicated, high-bandwidth layer connecting sites across a city without depending on the public internet.

How a MAN Actually Works

At its core, a MAN connects multiple LANs through a shared backbone. That backbone is typically built from fiber optic cables capable of carrying enormous amounts of data over distances of tens of kilometers without signal degradation. Fiber is preferred over copper because it handles higher bandwidth, resists electromagnetic interference, and supports the distances involved.

The backbone connects to each location through networking devices. Switches operate at Layer 2, directing frames between devices on the same network segment. Routers operate at Layer 3, making decisions about the best path for data to travel between different network segments. Together, these devices ensure traffic flows efficiently between all connected locations.

Many cities have unused fiber optic infrastructure — often called "dark fiber" — that was installed during earlier telecom buildouts but never activated. Organizations can lease dark fiber rather than laying their own cables, significantly reducing the cost and time needed to establish a MAN. Universities and municipalities are common dark fiber lessors.

A MAN can also serve as a bridge between local networks and the wider internet. Traffic that stays within the city routes through the MAN backbone at high speed, while traffic destined for external addresses passes through gateway routers that connect the MAN to one or more WANs or internet service providers.

The physics that make a metro link feel local

A well-built MAN feels like an extension of the office LAN rather than a remote connection, and the reason is propagation delay. The numbers are worth knowing because they set a floor that no equipment budget can beat.

Light travels through the glass core of a fiber at roughly two thirds of its speed in a vacuum, or about 200,000 kilometers per second. That works out to close to 5 microseconds per kilometer in each direction. A 50 km metro link therefore costs about 250 microseconds one way, or half a millisecond for a round trip, before any device touches the signal.

Half a millisecond is small enough to vanish underneath everything else in the path. A switch forwarding a frame adds a few microseconds. A router doing real Layer 3 work adds more. A congested queue can add several milliseconds on its own, an order of magnitude more than the glass ever will. In practice the fiber is almost never the slow part of a metro network: the equipment, the queuing, and the path traffic actually takes matter far more than the distance on a map.

Compare that with a wide area path. A link between two continents crosses thousands of kilometers of undersea cable, so the same physics produce 60 to 150 milliseconds of round-trip delay that no amount of money removes. That is the practical dividing line between the two scales. Within a metro, distance is negligible and engineering decides performance. Across a WAN, distance dominates and engineering only trims the edges.

This also explains a result that surprises people. Two sites 10 km apart can perform worse than two sites 40 km apart, if the shorter path routes through a congested aggregation point while the longer one runs on a clean wavelength. Physical distance and network distance are different measurements. Reading the path traffic actually takes, as covered in our guide to diagnosing latency, tells you more than the number of kilometers between two buildings.

Key Characteristics of a MAN

• Coverage area: Typically 5 to 50 kilometers, spanning a city, a cluster of campuses, or a metropolitan region.
• Speed: Moderate to high, typically ranging from 100 Mbps to 10 Gbps depending on the fiber infrastructure and equipment in use.
• Ownership: Usually operated by a single organization, a consortium of organizations, or a service provider — not a public utility.
• Topology: MANs can use ring, mesh, or star network topologies depending on redundancy requirements and the physical layout of connected sites.
• Backbone technology: Almost always fiber optic, sometimes supplemented by wireless links for locations where running cable is impractical.

Core Components

Fiber optic cables

The physical foundation of most MANs. Fiber uses thin glass strands to transmit data as light pulses, achieving speeds and distances that copper cable cannot match. Single-mode fiber is preferred for MAN backbones because it supports longer distances with less signal loss than multi-mode fiber.

Routers and switches

Routers handle inter-network traffic decisions — determining the best path between locations. Switches handle traffic within a network segment, forwarding data only to the port where the destination device is connected. In a MAN, these devices must handle high throughput because they aggregate traffic from multiple LANs simultaneously.

Wireless extensions

Where running fiber is physically difficult or cost-prohibitive, MANs can use point-to-point wireless links or technologies like WiMAX to bridge gaps. WiFi and wireless segments sacrifice some speed and reliability compared to fiber, but they extend the MAN's reach without trenching or permits.

LAN vs. MAN vs. WAN: How They Compare

Understanding where a MAN fits requires comparing it to the other computer networks above and below it in scale:

• LAN (Local Area Network): Covers a single building or campus, up to about 1 km. High speed (typically 1-10 Gbps), low cost, owned by one organization. Uses Ethernet and WiFi.
• MAN (Metropolitan Area Network): Covers a city or metro region, 5 to 50 km. Speed ranges from 100 Mbps to 10 Gbps. Moderate to high cost. Uses fiber optic cables. Owned by organizations, municipalities, or service providers.
• WAN (Wide Area Network): Covers cities, countries, or the entire globe. Speed varies widely and is generally lower than LAN or MAN for equivalent cost. High cost. Uses satellite links, leased lines, and undersea cables. Owned by ISPs, governments, or international consortiums.

The internet itself is the largest WAN. When you run an ASN lookup on an IP address, you are seeing how WANs are organized — each Autonomous System Number represents a network that participates in global BGP routing. A MAN typically operates within one or a few ASNs, while a WAN may span many.

Where a campus area network fits, and why CAN and MAN get confused

The table above includes a tier most explanations skip. A campus area network sits between a LAN and a MAN, and the two are confused constantly because the real boundary is about ownership rather than distance.

A CAN connects several buildings that sit close together and belong to one organization: a university quad, a hospital complex, a corporate campus, a military base. The defining feature is that the organization controls the ground between the buildings. It can trench its own conduit, run its own fiber, and never involve a carrier or ask a city for permission to cross a public street.

A MAN crosses ground the organization does not own. The moment a link has to pass under a public road, along a utility right of way, or through conduit belonging to someone else, the project changes character. Now it involves permits, a carrier or municipal fiber provider, a lease, and a service contract. The distance may only have grown from 2 km to 6 km, but the procurement, the legal exposure, and the failure modes are entirely different.

This is why the kilometer ranges quoted for each tier are approximations rather than definitions. A sprawling university with 4 km between its furthest buildings, all on land it owns, is running a campus network. Two office buildings 800 meters apart on opposite sides of a highway, connected through a leased metro Ethernet circuit, are using a MAN. Ownership of the path, not the length of it, is what separates them.

Most organizations run both at once. Each site has its own LAN, closely grouped buildings are stitched into campus networks, and the campuses are joined across the city by metro links. The tiers are layers of a single design rather than competing choices.

Benefits of a Metropolitan Area Network

Fast cross-site communication

Employees, students, or departments at different locations can share files, access databases, and use internal applications as if they were on the same local network. Latency stays low because traffic never leaves the MAN backbone.

Centralized resource sharing

Printers, servers, storage systems, and backup infrastructure can be shared across all connected locations. This reduces duplication and makes IT management more efficient compared to maintaining separate resources at every site.

Scalability

Adding a new building or campus to the MAN is straightforward — run fiber (or lease dark fiber) to the new location, install networking equipment, and connect it to the backbone. The core architecture does not need to be rebuilt each time the network grows.

Better security than public networks

Because MANs are typically private, traffic does not traverse the public internet. This reduces exposure to external threats. Combined with firewalls, encryption, and network monitoring, a MAN provides a more controlled security environment than routing inter-office traffic over a WAN.

Real-World Applications

Enterprise and corporate networks

Companies with headquarters, branch offices, and data centers in the same metro area use MANs to unify their networks. Finance, healthcare, and legal organizations especially benefit because they need fast, secure data transfer between locations that handle sensitive information.

University and research campuses

Large universities often span dozens of buildings across a city. A MAN connects lecture halls, labs, libraries, and administrative offices into a single high-speed network. Research institutions use the bandwidth for transferring large datasets between departments.

Municipal government

City governments connect police stations, fire departments, city hall, public utilities, and emergency services through MANs. Fast internal communication between these services directly impacts response times and coordination during emergencies.

Cable TV and telecommunications

Cable television providers distribute signals across metro areas using MAN infrastructure. Telephone networks that connect subscribers across a city also operate as MANs. DSL services that deliver internet through existing telephone wires use MAN-scale distribution.

Limitations Worth Understanding

• High upfront cost: Laying fiber optic cable across a city is expensive, especially in dense urban areas with existing infrastructure obstacles. Even leasing dark fiber requires significant investment in networking equipment.
• Maintenance complexity: A MAN requires specialized technical expertise to maintain. Fiber repairs, routing configuration, and capacity planning all demand experienced network engineers.
• Security is not automatic: While private networks are inherently more controlled, they are not immune to attacks. Physical access to fiber, compromised network devices, or insider threats can all expose a MAN. Strong encryption, access controls, and continuous monitoring are essential.
• Geographic constraints: A MAN is practical within a metro area. Once the distance exceeds roughly 50 km, the economics and technology shift toward WAN solutions.

Technologies That Power MANs

• Fiber optics: The backbone technology for nearly all modern MANs. Single-mode fiber handles the long distances involved.
• Ethernet: Metro Ethernet services deliver MAN connectivity using familiar Ethernet protocols, making integration with existing LANs straightforward.
• MPLS (Multi-Protocol Label Switching): Adds traffic engineering capabilities to the MAN, allowing prioritization of latency-sensitive applications like voice and video.
• IEEE 802.16 / WiMAX: A wireless broadband standard designed for MAN-scale distances. WiMAX can provide coverage across an entire city, serving areas where fiber is not available.
• 5G: The newest entrant. 5G cellular networks can deliver MAN-level speeds wirelessly, supporting IoT devices, smart city infrastructure, and real-time data applications at city scale.

MANs and the Future of Smart Cities

Metropolitan area networks are foundational infrastructure for smart city initiatives. IoT sensors for traffic management, environmental monitoring, and public safety all need fast, reliable network connectivity across urban areas — exactly what a MAN provides.

Smart grids that optimize energy distribution across a city depend on real-time data flowing between substations, meters, and control centers. Intelligent transportation systems use MAN connectivity to monitor traffic patterns, adjust signal timing, and route emergency vehicles. As 5G integrates into MAN infrastructure, the number of connected devices a city can support will increase dramatically.

SONET, SDH, and the legacy backbone MANs were built on

Before Ethernet-everywhere became the norm, large metropolitan backbones ran on SONET (Synchronous Optical Networking, the North American standard) or its international equivalent SDH (Synchronous Digital Hierarchy). These protocols defined a rigorous timing-synchronous frame structure that could carry voice circuits, leased lines, and data over the same fiber with very predictable latency.

SONET's ring topology with automatic failover (UPSR, BLSR) is one of the reasons MAN-class networks are so reliable in practice. If a fiber cut occurred anywhere on the ring, traffic automatically failed over to the alternate path in 50 milliseconds or less — fast enough that voice calls did not drop and TCP connections rarely noticed. Modern Ethernet rings with Rapid Spanning Tree and TRILL try to deliver the same resilience, though the timing guarantees are softer than SONET's.

Most carrier MANs in 2026 have migrated off SONET to packet- based Carrier Ethernet because it is cheaper and scales better, but the resilience patterns SONET pioneered still shape how modern metropolitan rings are designed.

Metro Ethernet services and the EVPL/EVPN you may see on a quote

When a business buys MAN connectivity from a carrier today, the product on the quote almost always uses one of a few Metro Ethernet acronyms defined by the MEF (Metro Ethernet Forum):

• E-Line / EPL / EVPL: Ethernet point-to-point service connecting two specific locations. EPL is unfiltered private line; EVPL is virtual and may share underlying fiber with other customers.
• E-LAN / EP-LAN / EVP-LAN: Ethernet multipoint- to-multipoint, connecting three or more sites into one logical LAN that spans the metro area. Useful for organizations with many sites that all need to talk to each other.
• E-Tree / EP-Tree: Hub-and-spoke Ethernet, where spoke sites talk only to the hub, not to each other. Common in retail chains with a central data center and many storefront locations.
• EVPN: Ethernet VPN, the more modern BGP- signaled multipoint Ethernet service that runs over MPLS or modern IP backbones. Increasingly the default for new metro deployments.

Knowing these acronyms helps when comparing carrier quotes because two providers may use slightly different terms for what is functionally the same service.

How metro rings survive a fiber cut

The single most likely way a metro link fails is not equipment. It is a backhoe. Construction crews, road works, and utility digs sever buried fiber regularly, and a cut strand does not degrade gracefully the way a congested link does. It goes from full capacity to nothing in an instant. Metro network design is shaped almost entirely around that fact.

The answer is to build the backbone as a ring rather than a set of point-to-point links. Every site connects to two neighbors, so traffic between any pair of sites has two possible directions around the loop. When a cut happens, the ring is broken in exactly one place, and every site can still reach every other site by sending traffic the other way. A ring survives any single cut. It is a mesh that has been trimmed to the cheapest topology that still tolerates one failure.

What matters operationally is how fast the switchover happens. Ring topologies are only useful if the recovery is faster than the applications running on top of them will notice. The SONET rings described above set the benchmark at 50 milliseconds, and modern packet networks aim at the same target using ERPS (Ethernet Ring Protection Switching, standardized as ITU-T G.8032), which blocks one link in the ring during normal operation and unblocks it the moment a failure is detected.

Fifty milliseconds is not an arbitrary number. It is short enough that a voice call does not drop, a video stream does not rebuffer, and a TCP connection does not time out and restart its congestion window. Recovery that takes several seconds is technically still automatic failover, but every session on the network notices, and for a hospital or an emergency dispatch center that difference is the entire point of the investment.

Two design mistakes recur. The first is a ring that is logically redundant but physically single-homed, where both directions of the loop run through the same conduit or the same building entrance. One backhoe takes out both paths, and the ring provides no protection at all. The second is a ring whose two paths share a single upstream gateway to the internet. Sites keep talking to each other after a failure, but nothing reaches the outside world. Redundancy has to be verified physically, not just drawn on the logical diagram.

Dark fiber, lit service, or carrier Ethernet

Deciding to connect sites across a city is the easy part. The harder question is what you actually buy, because the same metro link is sold in three quite different shapes, and they demand different amounts of in-house expertise.

Dark fiber is the cheapest per bit and the most demanding. You lease the physical strand and nothing else, then buy the optics at both ends and light it yourself. Because capacity is set by the transceivers you plug in rather than by a contract, upgrading from 10 Gbps to 100 Gbps can mean swapping optics rather than renegotiating a service. The catch is that every fault is yours to diagnose, and diagnosing optical faults needs both skills and instruments most IT teams do not have.

A lit service or leased wavelength moves the optical layer to the provider. You get a circuit at an agreed capacity and hand off Ethernet at each end. Carrier Ethernet goes one step further and delivers a managed service with a bandwidth profile and an availability commitment, using the E-Line, E-LAN, and E-Tree service types described earlier.

The deciding factor is usually staffing rather than budget. An organization with network engineers on payroll and a 24-hour operations rotation can extract real savings from dark fiber over a multi-year lease. An organization whose IT team is three people who also run the help desk should buy a managed service, because the discount on dark fiber is quickly erased by the first outage nobody on staff can trace.

Encryption on metro links, and why private does not mean confidential

A recurring assumption is that a private metro link needs no encryption because traffic never touches the public internet. That reasoning does not hold, and the reason is physical.

Fiber running between buildings passes through street cabinets, manholes, shared risers, and carrier facilities. Optical taps that bleed a small fraction of the light off a strand exist, are not exotic, and leave the link working normally while they do it. Leased dark fiber is worse in this respect than fiber you own, because the path crosses infrastructure you have never seen and cannot inspect. Private describes who pays for the circuit, not who can physically reach it.

The standard answer at metro scale is MACsec, defined in IEEE 802.1AE. MACsec encrypts Ethernet frames at Layer 2, between two directly connected devices, which makes it a natural fit for a link between two switches at either end of a metro span. Because it operates below the IP layer, it protects everything crossing the link without any application needing to know it is there, and it runs in hardware on the interface, so a correctly specified switch encrypts at full line rate.

Its limitation is the same as its strength: MACsec is hop-by-hop. Each frame is decrypted at the far end of the link, so if traffic crosses several devices, each hop must be secured individually. Where traffic is routed rather than switched, IPsec at Layer 3 is the tool that survives intermediate hops. Many designs use both, with MACsec protecting the exposed metro span and IPsec or TLS protecting sensitive flows end to end. That layering also complements the perimeter controls covered in our guide to firewalls.

SD-WAN changed the build-or-buy question

For most of the history of metro networking, connecting sites across a city meant private circuits, because the public internet could not offer predictable performance. That assumption is weaker now, and any honest discussion of MANs has to account for it.

SD-WAN takes a different approach. Instead of buying dedicated connectivity, each site gets ordinary business broadband, often two connections from different providers, and an appliance builds encrypted tunnels over whatever is available. Software then steers each application onto the path that currently suits it, measuring loss, latency, and jitter continuously and moving traffic when a path degrades.

The economics are frequently compelling. Two commodity fiber connections can cost a fraction of one metro Ethernet circuit at the same headline bandwidth, and provisioning takes days instead of the months a new metro build can require. For a retail chain with forty locations, that difference decides the architecture.

What SD-WAN cannot do is change the underlying paths. It selects among the routes the internet already provides. Two sites in one city may reach each other through an exchange point in another region entirely, adding latency a direct metro link would not have. There is no availability commitment on a commodity circuit, and no guarantee that two providers serving one building do not share the same physical entrance. For workloads that genuinely need bounded latency and contractual uptime, clinical imaging, trading, industrial control, emergency dispatch, the dedicated metro link is still the answer. For general office traffic that tolerates variance, SD-WAN is usually the better buy.

Worked example: connecting four sites across one city

An abstract description of a MAN is harder to hold onto than a concrete one, so consider a mid-sized hospital group with four locations in the same metro area.

• Main hospital with the primary data center, imaging archive, and the electronic records system.
• Second hospital 12 km away, which needs full access to records and imaging and hosts the backup data center.
• Outpatient clinic 7 km from the main site, running scheduling, records access, and a handful of imaging devices.
• Administrative offices 4 km away, with no clinical systems but full access to business applications.

The requirement that drives everything is imaging. A single CT study runs to hundreds of megabytes and a radiologist at one site must open a study captured at another without a visible wait. That rules out anything latency-variable and sets the capacity floor.

The design is a fiber ring connecting all four sites, with each location holding two diverse paths to its neighbors. The two hospitals get 10 Gbps interfaces because they carry the imaging traffic and replicate between the primary and backup data centers. The clinic and the offices connect at 1 Gbps, which is ample for their load. MACsec runs on every metro span, because patient data crossing conduit under public streets is exactly the case where the physical argument above applies.

Internet access is deliberately not distributed. Both hospitals hold a gateway to the outside world, each with its own provider, and the clinic and offices reach the internet through the ring rather than through local broadband. Concentrating egress at two hardened points means one set of firewall policies, one place to inspect outbound traffic, and two upstream networks instead of four. It also means the public IP a clinic device presents belongs to the hospital group rather than to a consumer broadband account, which matters for allowlisting with external systems.

What the ring buys is specific. If the 12 km span between the hospitals is cut, traffic reverses around the loop through the clinic and offices, and imaging keeps working at reduced headroom. If one internet gateway fails, all four sites still reach the outside through the other. If the main data center goes down entirely, the second hospital already holds a replicated copy across a link fast enough to have kept it current. None of that is available from four independent broadband connections at any price.

Common mistakes when planning a metro network

Most metro network disappointments are not exotic. They come from a small set of assumptions that seem reasonable on paper and fail once traffic is real.

• Buying bandwidth when the problem is latency. An application that stalls on a slow link and an application that stalls on a variable one look identical to users, and only one is fixed by a bigger circuit. Chatty protocols that wait for an acknowledgement before sending the next request are bound by round trips, not by capacity, and doubling the bandwidth changes nothing for them.
• Accepting a diversity claim without a route map. Two circuits sold as diverse paths regularly share a stretch of conduit, a bridge crossing, or the same entrance into a building. Ask the provider for the physical route of both, in writing, and check where they converge. Diversity that exists only in the order-entry system is discovered during the outage.
• Overlooking the building entrance. A ring can be perfectly diverse across the city and still terminate through one conduit into one riser in one basement. That last hundred meters is frequently the least redundant part of an otherwise careful design, and it is also where flooding and construction do their damage.
• Sizing for the average instead of the peak. Metro traffic is rarely smooth. Overnight backups, replication windows, and bulk transfers arrive in bursts that dwarf the daily mean. A link sized to the average will be saturated exactly when the batch jobs run, which is usually when nobody is watching.
• Mismatched MTU across the handoff. If jumbo frames are enabled on the site LANs but the metro service delivers a standard 1500-byte MTU, the symptom is not a clean failure. Small packets pass, large transfers hang, and the fault looks intermittent and application-specific. Confirm the MTU the provider actually supports end to end, including any encapsulation overhead their service adds.
• Centralizing services with no local survivability. Consolidating DNS and DHCP at the main data center is efficient right up to the moment a site is isolated. Without a local resolver and a local address pool, that site loses its own internal networking too, turning a link outage into a total outage.
• Never testing the failover. Protection switching that has not been exercised is a hypothesis. Schedule a maintenance window, break one side of the ring deliberately, and measure what actually happens to live sessions. The time to learn that recovery takes eight seconds rather than fifty milliseconds is not during a fiber cut.

Frequently asked questions

Is a MAN the same thing as a WAN?

No. A MAN covers a city or metro region, roughly 5 to 50 km, and is usually operated by one organization, a municipality, or a carrier selling metro service. A WAN spans cities, countries, or continents and is assembled from leased carrier links. The practical difference is latency: a metro link adds well under a millisecond, while an intercontinental path adds 60 to 150.

Who owns a metropolitan area network?

It varies, and the answer determines how the network is run. Some are owned outright by a single organization such as a university or hospital group. Some are municipal, built by a city and leased to local organizations. Many are carrier-operated, with businesses buying metro Ethernet services over shared infrastructure. A dark fiber lease sits in between: the customer operates the network, but does not own the glass.

Do I need a MAN, or will SD-WAN do?

Ask what happens when latency varies. If the answer is that a video call gets briefly worse, SD-WAN over commodity broadband is almost certainly the better value. If the answer involves clinical imaging, industrial control, trading, or emergency dispatch, the contractual latency and availability of a dedicated metro link is what you are actually buying, and commodity circuits cannot provide it.

Is a metropolitan area network secure by default?

No. Keeping traffic off the public internet removes a large class of remote attacks, but the fiber still runs through cabinets, manholes, and facilities outside your control, and optical taps are real. Treat a metro link as private but not confidential, and encrypt it with MACsec at Layer 2 or IPsec at Layer 3.

How fast is a metropolitan area network?

Typical metro services run from 100 Mbps to 10 Gbps, and carrier infrastructure supports considerably more. The number worth attending to is not headline bandwidth but latency and its consistency. Distance within a metro contributes well under a millisecond, so a slow MAN is almost always the result of congestion, an inefficient path, or undersized equipment rather than the fiber itself.

How This Relates to IP and Network Diagnostics

Whether your traffic passes through a LAN, MAN, or WAN, the diagnostic principles are the same. Your public IP address is assigned by the network that connects you to the internet — often at the point where a MAN meets a WAN gateway. Tools like IP lookup show what the outside world sees, regardless of how many internal network layers your traffic has crossed.

If you are troubleshooting connectivity within a metro-scale network, these tools help identify where issues occur:

• DNS Lookup — verify that internal and external DNS resolution works correctly across all MAN-connected locations.
• ASN Lookup — identify which autonomous system announces the IP range your MAN connects through.
• Reverse DNS — check PTR records to confirm hostnames are configured correctly for servers on the MAN.
• WHOIS / RDAP — look up allocation data for IP ranges used within the MAN.
• IP Blacklist Check — ensure that the MAN's public-facing IPs have not been flagged on reputation lists.