Power over Ethernet for Cameras and Access Points

Why this matters

Power over Ethernet (PoE) is how most wired security cameras and ceiling-mounted Wi-Fi access points get their power: one cable carries both data and electricity, so there is no receptacle at the camera and no electrician on the job. It is also the source of one of the most argued-about callbacks in connected-home work, the camera that goes dark at 2 a.m. and is fine every time somebody comes to look at it. Almost always the camera is healthy and the switch feeding it has run out of watts. A tech who can read a power budget settles that in ten minutes; one who cannot replaces a good camera and comes back next week.

How the power gets there

Two roles. The power sourcing equipment (PSE) supplies the power: a PoE switch (called an endspan) or a separate injector placed between an ordinary switch and the device (a midspan). The powered device (PD) is the camera, access point, doorbell station or door controller that receives it.

It negotiates before it powers. A standard PSE does not just put voltage on the cable. It first probes for a signature resistance that says a PoE device is present, then reads the device's class, which states how much power it may need, and only then turns the power on. That handshake is why plugging a laptop into a PoE port does not hurt the laptop.

The voltage is around 50 V DC. The IEEE 802.3 standard sets the PSE output at roughly 44 to 57 V for the original type and 50 to 57 V for the higher types, on two or all four pairs of the cable. It is a power-limited source and not a shock hazard in normal handling, but it is enough to arc and pit contacts if a connector is pulled under load, so seat connectors fully and do not splice PoE cable.

What PoE is not: passive injectors. Some low-cost gear uses "passive PoE", a fixed 24 V or 48 V put on the cable with no negotiation at all. Plug a standard device into a passive injector of the wrong voltage and you can damage it; plug a passive device into a standard switch and it simply will not power. If the label on an injector does not name the IEEE standard and a type, treat it as passive and match it to the device's sheet exactly.

The numbers that matter, by type

Why two columns. The gap between them is what the standard allows to be lost as heat in the cable over a full-length run. The switch spends the left-hand column; the device can count on the right-hand column. A switch's per-port power readout is at the switch, so it includes the cable loss, and that is the figure that counts against the switch's budget.

Device class inside a type. Within Type 1 and Type 2, devices declare a class. Class 3 is the top of Type 1 (up to the full 15.4 W at the PSE) and Class 4 is Type 2 (up to 30 W at the PSE). Most fixed indoor cameras are Class 2 or Class 3; cameras with heaters, motorized zoom or bright infrared illuminators, and most current access points, are Class 4 or higher. Read the device's sheet for both its class and its maximum draw.

The power budget is the whole game

A PoE switch has two independent limits: a per-port limit (its PoE type) and a total budget across all ports, which is often far less than every port running flat out. An eight-port PoE+ switch can support 30 W on any one port and still have a total budget that covers only two or three of them at full power. The budget is printed in watts on the sheet and usually on a label.

Switches account for the budget in one of two ways, and which one yours uses changes the symptom completely:

• Allocation by class. The switch reserves the class maximum for each device the moment it powers up, whether the device uses it or not. When the reservations reach the budget, the next device is refused at plug-in. The failure is immediate and visible on install day.
• Allocation by measured draw. The switch counts what each port is actually drawing. More devices fit, because most draw well under their class. But when the devices' draw rises together, the total can cross the budget hours after install, and the switch then cuts power to a port to protect itself, usually the lowest-priority port, which by default on many switches is the highest-numbered one.

Some switches let you choose the mode and set port priorities. Check the setting before you trust a budget calculation.

Why a camera reboots at night

Cameras draw more power at night, for reasons that line up with each other:

• Infrared illuminators switch on at dusk, and they are often the largest single load in the camera.
• Heaters and blowers in outdoor housings switch on in cold weather, usually at night.
• The day-night filter switches mechanically at dusk and dawn, a brief extra draw.

So the budget that was comfortable at the noon install is overspent at 2 a.m. in January. On a switch allocating by measured draw, the switch sheds the lowest-priority camera; the camera's load leaves, the total falls back under the budget, the switch re-detects the camera and powers it, it boots straight back into night mode, and the total crosses again. The result is a camera that reboots every few minutes from dusk to dawn and records nothing useful, and a switch log that says so plainly if anyone reads it.

Worked example: the back-yard camera that goes dark in winter

The complaint. A customer's back-yard camera shows gaps in its recording every night since the first hard frost. It is fine every time it is checked in daylight. It was installed in the summer with four other cameras and a ceiling access point, all on one eight-port PoE+ switch in a utility closet. The switch's sheet states a total PoE budget of 60 W.

The per-port readings. The switch's management page shows each port's draw. In the afternoon: each camera about 6.0 W, the access point 9.0 W. Total: 5 x 6.0 = 30.0 W plus 9.0 W = 39.0 W against a 60 W budget, which is the reading the installer saw and was satisfied with.

The night picture. The switch's log, read the next morning, carries the story:

POE BUDGET 60.0 W      02:10  USED 59.0 W
PORT  DEVICE        CLASS  DRAW W
1     access point  4       9.0
2     cam front     3      10.0
3     cam garage    3      10.0
4     cam side      3      10.0
5     cam patio     3      10.0
8     cam backyard  3      10.0
02:13 port 4 draw 13.0 W
02:13 port 5 draw 13.0 W
02:13 port 8 power denied: budget exceeded
02:13 port 8 powered off
02:15 port 8 class 3 detected, powered on
02:19 port 8 power denied: budget exceeded

Reading it: at 02:10 every camera draws 10.0 W with its infrared on, and the total is 9.0 + (5 x 10.0) = 59.0 W, one watt under the budget. At 02:13 the housing heaters on two of the three outdoor cameras (ports 4 and 5) switch on, adding 3.0 W each: 59.0 + 6.0 = 65.0 W, over the budget, so the switch sheds port 8, the highest-numbered port. With the back-yard camera off, the total is 65.0 - 10.0 = 55.0 W. The switch re-powers the port, the camera boots in the cold with its own heater running at 13.0 W, and the total becomes 55.0 + 13.0 = 68.0 W, which is 8.0 W over the 60 W budget. The switch sheds it again, and the loop runs until dawn.

Why the summer reading misled. The installer measured at the time of day when every camera's two biggest loads, illuminators and heaters, were off. The afternoon figure of 39.0 W was 57 percent of the worst case of 68.0 W, so the "21 W of headroom" the installer saw was really an 8 W deficit waiting for winter.

The decision. A shop default worth adopting is to plan the switch budget against every device's worst-case draw from its sheet, then keep the total at or below 80 percent of the budget. Here the sheets list the three heated outdoor cameras at 13.0 W maximum, the two unheated models (front and garage, under the eaves) at 10.0 W and the access point at 9.0 W, which matches the night readings, so the worst case is the 68.0 W already measured. The budget needed is 68.0 / 0.8 = 85 W, so a switch with 90 W or more of PoE budget clears it. Two other fixes would also work: moving two outdoor cameras to individual standards-based midspan injectors (taking 26.0 W off the switch and leaving it at 42.0 W, 70 percent of 60 W), or turning off the housing heaters if the camera's sheet rates it for the climate without them. The shop replaced the switch, because the customer also wanted two more cameras next year.

What changes the answer: a switch allocating by class. Had this same 60 W switch reserved by class, the five Class 3 cameras would reserve 5 x 15.4 = 77.0 W on their own, plus 30 W for the Class 4 access point, 107.0 W in all. It would have refused power to devices on install day. That is a better failure: it happens in front of the installer. The measured-draw switch let the install look healthy and moved the failure to 2 a.m.

What to check before blaming the camera. If the switch has no management page and no log, the tell is the pattern itself: reboots that start at dusk, worsen in cold weather and stop at dawn, on more than one camera or always on the highest-numbered port. A camera with a genuine internal fault reboots on its own schedule, day or night.

The 100 m run limit, and what eats into it

Ethernet over twisted-pair copper is specified to a 100 m (328 ft) channel: up to 90 m of permanent cable in the walls plus up to 10 m total of patch cords at the two ends, per the TIA-568 cabling standard. PoE inherits the same limit, and the power loss the standard allows (the gap in the table above) assumes that length on compliant copper cable.

Three things push a run past what the power side tolerates even inside 100 m:

• Copper-clad aluminum (CCA) cable. It looks like Category cable and is sold cheaply, but its conductors have markedly higher resistance than solid copper, so the voltage at the device sags and the cable runs warmer. It does not meet the TIA standard and many manufacturers will not support PoE on it. Read the jacket: compliant cable says copper.
• Bundles carrying high power. Type 3 and Type 4 PoE in large bundles heats the cable. The NEC addresses this in the Class 2 article with a table limiting current by bundle size and conductor gauge (725.144 in the 2017 and 2020 editions; check the edition your jurisdiction adopted).
• Too many connections in the channel. Every coupler, patch panel and keystone adds resistance and a place to fail. A run with three couplers in an attic is a run you will be back to.

When a camera has to sit past 100 m, use a standards-based PoE extender or a switch closer to the camera, not a longer cable.

How to verify you got it right

• The switch's PoE budget, its allocation mode and its port priorities are written on the job record, with the night-time draw if you can read it.
• The sum of every device's sheet maximum is at or below 80 percent of the budget, or you have written down why not.
• Every run is on solid copper Category cable, under 100 m including patch cords, terminated and tested end to end.
• The customer's most important camera is on the highest-priority port, so if the switch ever does shed a load, it sheds the least important one.

References

• IEEE 802.3 (af, at and bt amendments) for PoE types, PSE output and powered-device power
• ANSI/TIA-568 for the 100 m channel and Category cable requirements
• NEC Class 2 article (725.144 in the 2017 and 2020 editions) for power-over-communications-cable bundles, in the edition adopted by your authority having jurisdiction
• Manufacturer documentation for the switch's budget and allocation mode and for each device's class and maximum draw
• See related: Ethernet Cable Categories and Terminations; Terminating and Testing an Ethernet Cable; Low-Voltage Wiring Basics for Non-Electricians