SFP+, SFP28, QSFP28 and QSFP-DD: Choosing Optics and Fiber for 10 to 400 Gb/s

Two decisions hidden in one name

When someone orders an optic, two separate choices are folded into one part number. The first is the form factor, which is the shape of the module and the number of electrical lanes it exposes to the switch chip. SFP+, SFP28, QSFP28 and QSFP-DD are form factors. The second is the port type, which is the optical interface the module presents to the fiber: how many wavelengths, what modulation, what fiber, how far. 100GBASE-SR4 and 100GBASE-LR4 both fit in a QSFP28 cage, yet they use different fiber and connectors and cannot talk to each other.

Keeping the two apart makes the rest of the planning easier. The form factor must match the switch port. The port type must match the other end of the link and the fiber in the walls. Reach, power and cost follow from the port type. This article takes the form factors first, then the port types speed by speed, then the cables and the planning rules that prevent most of the mistakes we see.

The module families

The small form-factor pluggable modules are specified through multi-source agreements run by the SFF Committee, not by IEEE directly. IEEE 802.3 defines the Ethernet port types and the electrical interface behind them; the module documents define the mechanical shape, the management interface and the connector. Wikipedia's summary of the specifications lists SFP+ in SFF-8431 for 10 Gb/s, SFP28 in SFF-8402 for 25 Gb/s, QSFP+ in SFF-8436 for 40 Gb/s on four 10 Gb/s channels, QSFP28 in SFF-8665 for 100 Gb/s on four lanes, QSFP56 for 200 Gb/s using PAM4 signaling, and QSFP-DD in INF-8628 for 400 Gb/s on eight lanes. OSFP, from its own MSA, targets eight lanes too and is the larger cousin used where more power must be cooled.

The pattern is simple. Each step either doubles the lane speed or multiplies the lane count. SFP+ is one lane at 10 Gb/s. SFP28 is one lane at 25 Gb/s. QSFP28 is four lanes at 25 Gb/s. QSFP-DD adds a second row of contacts to make eight lanes, and at 50 Gb/s per lane using PAM4 (four-level pulse amplitude modulation) it reaches 400 Gb/s. PAM4 carries two bits per symbol, which is why it doubles the rate without doubling the symbol rate, and why it is less tolerant of noise than the two-level signaling used up to 25 Gb/s. Backward compatibility is deliberate: a QSFP-DD cage accepts QSFP28 modules, and an SFP28 cage accepts SFP+ modules, usually at the lower speed. Check the switch vendor's documentation for the exact combinations it supports.

10 Gb/s: SFP+ and the IEEE 802.3ae port types

10 Gigabit Ethernet came from IEEE 802.3ae-2002. The optical port types you will meet in SFP+ form are 10GBASE-SR, 10GBASE-LR and 10GBASE-ER. SR (short reach) uses 850 nm light on multimode fiber and reaches 300 m on OM3 and 400 m on OM4. LR (long reach) uses 1310 nm on single-mode fiber and reaches 10 km. ER (extended reach) uses 1550 nm on single-mode and is specified to 40 km on engineered links and 30 km on standard links. A 10GBASE-ZR optic at 80 km exists, but the sources we read note that it is not part of IEEE 802.3ae; it is a multi-vendor practice, so interoperability across vendors needs testing.

Copper alternatives matter at 10 Gb/s because they are common. 10GBASE-T, from IEEE 802.3an (Clause 55), runs over twisted pair: 100 m on Category 6A and about 55 m on Category 6. It uses more power and adds latency compared with SFP+, which is why data-center switches prefer SFP+ with DAC or fiber. SFP+ direct-attach cables, built to SFF-8431, come as passive copper up to about 7 m, active copper up to about 15 m, and AOC up to about 100 m.

25 Gb/s: SFP28

25 Gigabit Ethernet was defined for server connections by IEEE 802.3by-2016, with the single-mode extensions in 802.3cc-2017. The port types are 25GBASE-CR for twin-axial copper (5 m), 25GBASE-CR-S (3 m, without the extra forward error correction), 25GBASE-SR on multimode (70 m on OM3, 100 m on OM4, 850 nm), 25GBASE-LR (10 km) and 25GBASE-ER (40 km) on single-mode. The line rate is 25.78125 GBd using NRZ signaling with 64b/66b encoding, which is why a 25 Gb/s link needs a lane that runs slightly above 25 Gb/s.

The important planning detail is the multimode reach. Moving from 10G to 25G over the same OM3 fiber cuts the guaranteed distance from 300 m to 70 m. For a server row, 70 m is plenty. For a link between floors or between buildings in a campus, check the real cable length including patch cords and the slack in the pathway before assuming that the old 10G fiber will carry the new speed.

100 Gb/s: QSFP28

100 Gigabit Ethernet has several generations. The first used ten lanes of 10 Gb/s: 100GBASE-SR10 (IEEE 802.3ba, Clause 82, 20 fibers, 100 m on OM3 and 150 m on OM4) and CR10 over copper. Both are phased out. The current generation uses four lanes of 25 Gb/s. 100GBASE-SR4 (IEEE 802.3bm, Clause 95) uses four transmit and four receive fibers on an MPO-12 connector, and reaches 70 m on OM3 and 100 m on OM4. 100GBASE-CR4 is a copper cable of about 5 m. 100GBASE-LR4 and ER4 (IEEE 802.3ba, Clause 88) use a duplex LC connector and four wavelengths near 1310 nm multiplexed onto one fiber pair. The LAN-WDM grid is about 1295.56, 1300.05, 1304.59 and 1309.14 nm. LR4 reaches 10 km and ER4 40 km on single-mode.

The choice between SR4 and LR4 is mostly about fiber. SR4 uses eight fibers of a parallel multimode cable and is cheap and low-power, but it needs MPO trunks and gives only 100 m. LR4 uses one duplex pair of single-mode and costs more per module, but it reuses the same fiber you would install anyway for any link above a few hundred meters. Many operators also use a lower-cost single-mode option for short links in data centers, such as the 2 km and 500 m variants defined by multi-source agreements, and these are worth checking with the switch vendor. They are not IEEE 802.3 port types, so treat them as vendor-supported interfaces.

400 Gb/s: QSFP-DD and the 802.3bs family

400 Gigabit Ethernet was defined by IEEE 802.3bs-2017, with later amendments adding more reach options. The main port types are these. 400GBASE-SR8 (802.3cm, Clause 138) uses eight lanes at 50 Gb/s on 16 multimode fibers with an MPO-16 connector: 70 m on OM3, 100 m on OM4 and OM5. 400GBASE-SR4.2 (802.3cm, Clause 150) sends two wavelengths (850 and 912 nm) in both directions on each of eight fibers, reaching 70 m on OM3, 100 m on OM4 and 150 m on OM5. On single-mode, 400GBASE-DR4 (802.3bs, Clause 124) uses four lane pairs on an MPO-12 connector and reaches 500 m. 400GBASE-FR4 (802.3cu, Clause 151) multiplexes four wavelengths onto a duplex LC pair and reaches 2 km, with 400GBASE-LR4-6 reaching 6 km. 400GBASE-LR8 (802.3bs, Clause 122) uses eight wavelengths for 10 km, and 400GBASE-ER8 (802.3cn) reaches 40 km.

Two points deserve attention. First, the lane count in the optic and the lane count in the switch chip need not match: the module contains a gearbox when the optical lanes are faster than the electrical ones. Second, a 400G module dissipates more power and heat than a 100G module. We do not quote a wattage because it varies by module and vendor; read the datasheet and check the switch's per-port and per-chassis power and airflow budget before filling every cage.

Reading OM3, OM4, OM5 and OS2

The OM and OS names are fiber grades from the ISO/IEC 11801 cabling standard. OM3, OM4 and OM5 are multimode fibers with a 50 micrometer core, designed for 850 nm VCSEL lasers; each grade has higher effective modal bandwidth than the last, which is why OM4 reaches farther than OM3 at the same speed. OM5 adds support for the second wavelength used by short-wavelength WDM such as 400GBASE-SR4.2. OS2 is single-mode fiber for 1310 and 1550 nm. These grade definitions are general cabling knowledge, not something we quote from the IEEE tables above. The reach numbers in the tables are maximums on a compliant channel: a link with many connectors, a dirty ferrule or a tight bend can fail inside the stated reach.

The practical rule: install OS2 single-mode for anything that leaves the room or might need to scale, install OM4 (or OM5) multimode only where short, cost-sensitive links justify it, and never mix grades inside one link. Mixing 50 micrometer multimode with single-mode, or OM3 with OM4, produces a link whose reach equals the weakest section, or no link at all.

DAC, AOC and breakout

A direct-attach cable is a copper cable with the transceiver ends permanently attached. It needs no fiber, costs less and uses less power than two optics, and is the default for top-of-rack connections up to a few meters. The limit is the reach quoted above: roughly 7 m passive at 10G, 5 m at 25G and 100G (CR and CR4 types). An active optical cable has fiber between two fixed transceiver ends, reaches up to about 100 m, and is lighter and thinner than copper, which helps airflow in dense racks. Neither can be repaired or reused for a different distance. A failed end means a new cable.

Breakout splits one high-speed port into several lower-speed links. A QSFP+ port can run as four 10 Gb/s connections, which is how a 24‑port QSFP+ switch can offer 96 ten-gigabit ports. Fanout cables from QSFP28 to four SFP28 and from QSFP56 to four SFP56 exist for the same purpose, and a QSFP-DD port can run at reduced width on four, two or one lane. In optics, 100GBASE-SR4 and 400GBASE-DR4 use separate fibers per lane, so a parallel MPO cable can fan out to four duplex LC connectors and feed four lower-speed ports. The switch has to be told to split the port, and the two ends must agree on the lane mapping, so a breakout design belongs in the plan from the start.

400ZR: coherent optics in a pluggable

Everything above is direct-detect optics: the receiver measures light intensity. Past a few tens of kilometers, direct-detect gives out, and networks use coherent optics, which encode data in the phase and polarization of the light and use a digital signal processor to recover it. 400ZR is a specification from the Optical Internetworking Forum (OIF). Its first version was published in March 2020, and the current version, OIF-400ZR-03.0, is dated October 2024. It describes a single-carrier 400 Gb/s interface using dual-polarization 16‑QAM modulation and a concatenated forward error correction code, so that operators can plug a coherent interface into a QSFP-DD or OSFP port in a router or switch. Sources describe a reach of 80 km or more without amplification and up to 120 km with amplification on a DWDM grid. The OIF does not prescribe the form factor; QSFP-DD is the more common choice.

The benefit is architectural. A data-center interconnect that once required a stand-alone optical transport shelf can now use a pluggable in the router, with wavelengths multiplexed onto one fiber pair by a passive DWDM filter. The cost is power and heat in the router, and a need to manage wavelength, power levels and amplifiers. IEEE explored a similar project (802.3cw, 400GBASE-ZR), but our source states it was cancelled in 2024, which is why 400ZR lives in the OIF and not in the IEEE 802.3 port-type list.

Planning rules that prevent mistakes

• Write down the fiber first: grade, connector type (LC, MPO-12, MPO-16), polarity, measured length and loss. Pick the port type second.
• Match both ends. SR talks to SR, LR4 to LR4. A 100GBASE-LR4 module will not link with a 100GBASE-SR4 module, and a 25G module will not run a 10G link unless both modules and the switch support dual rate.
• Check the switch vendor's list of supported and coded modules. Some switches reject third-party modules, or limit them, and firmware changes alter this over time.
• Clean every connector before it is mated. Contamination is among the most common causes of marginal links, and it matters more at higher speeds.
• Use the module's digital diagnostics (transmit and receive power, temperature) in monitoring from the first day, so a degrading link shows up before it drops.
• Plan power and cooling for the cage population, not for the average. Check airflow direction when mixing DAC, AOC and optical modules in one switch.
• Keep one or two spare modules of each type on site, and label breakout cables at both ends with the port and lane mapping.

Where this meets the rest of the network

Optics are the floor of a larger design. The speed of a leaf-to-spine link sets the oversubscription of a data-center fabric. The reach of a single-mode link sets whether two buildings can share one VXLAN-EVPN domain. Our team designs and operates networks from SFP+ access ports to 100 Gb/s fabrics, and we treat the optical plan as part of the routing and security plan, not a purchasing detail. Related reading: Network Time for Security and Trading: NTP, NTS and PTP (PTP needs hardware-timestamping optics and switches).

Sources

• Wikipedia - Small Form-factor Pluggable (SFP+, SFP28, QSFP28, QSFP-DD, DAC, AOC, breakout)
• Wikipedia - 10 Gigabit Ethernet (IEEE 802.3ae, 802.3an, port types and reach)
• Wikipedia - 25 Gigabit Ethernet (IEEE 802.3by, 802.3cc)
• Wikipedia - 100 Gigabit Ethernet (IEEE 802.3ba, 802.3bm)
• Wikipedia - 400 Gigabit Ethernet (IEEE 802.3bs, 802.3cm, 802.3cu, 802.3cn, 802.3cw)
• OIF - Implementation Agreement OIF-400ZR-03.0
• Effect Photonics - A Story of Standards: From 400ZR and Open ROADM to OpenZR+
• OIF - 400ZR, 800ZR and multi-span coherent pluggables (ECOC 2024)

This article is general technical information, not a design for your network. The IEEE 802.3 clauses and reach figures come from Wikipedia's tables, which summarize the standards; the IEEE texts are paywalled, so confirm any figure against the standard and your module datasheet. The fiber grade descriptions (OM3, OM4, OM5, OS2), PAM4 explanation, gearbox remark, cleaning advice and power remarks are general engineering knowledge, not quoted from the sources listed. The QSFP-DD MSA site was not reachable when we reviewed this. Vendors differ on which modules and breakout modes each switch supports. Last reviewed November 8, 2026.

Keep reading

Next · SecurityMicrosegmentation: From VLANs and Firewall Zones to Identity-Based PolicySegmentation limits how far an intruder can travel after the first foothold. Most networks start with VLANs and a perimeter firewall, which is a coarse form of the idea. Microsegmentation narrows the boundary to a single workload and writes the rules in terms of what the workload is and who is calling it, not which subnet it sits in. This article follows the path from VLANs and zones to identity-based policy, using NIST SP 800-207, NIST SP 800-125B and the CISA Zero Trust Maturity Model, and explains where each step pays off and where it hurts.10 min read

• SPF, DKIM and DMARC: Why Email Authentication Matters, and How a Resilient Exchange or Microsoft 365 Platform Is Run9 min
• Backups That Actually Restore: 3-2-1, Immutability, Restore Tests and Hurricane Season for Coastal Firms9 min