A method performed in an optical line terminal (OLT) in a passive optical network (PON) for detecting a rogue optical network unit (ONU) operating among a plurality of ONUs in the PON. The OLT receives a plurality of bursts of light from a plurality of ONUs, each burst being separated from other bursts by an inter-burst gap containing a minimum dark interval during which the OLT expects to receive no optical power. The OLT measures the received optical power during one or more of the minimum dark intervals of the inter-burst gaps and determines whether the inter-burst gaps were anomalous. In response to determining that an inter-burst gap was anomalous, the OLT increments an anomaly count that indicates a rogue ONU has been detected when the anomaly count exceeds an anomaly count threshold. When the anomaly count is exceeded, the OLT declares an alarm associated with the presence of a rogue ONU, and may also initiate rogue isolation diagnostics.