Intrusion detection of one section only of a multimode fiber uses a light signal launched into the fiber at a location spaced from the source through a single mode fiber to establish a narrow spectral width, under-filled non-uniform mode field power distribution in the fiber. A small portion of the higher order signal modes at the a second location also spaced from the destination is sampled by a tap coupler and monitored for transient changes in the mode field power distribution which are characteristic of intrusion to activate an alarm. A fiber being used for data transmission can be monitored for intrusion by introducing a monitor wavelength different from that of the data signal. Central to this invention is the use of a bulk optic (commonly referred to as a pass/reflect) wavelength division multiplexer, one which maintains the modal distribution within the fiber.