Network Switches

Work out three numbers: ports, PoE budget and uplink speed. For ports, add one or two ports for the NVR and the uplink to the number of cameras and allow about 20% spare for growth; for 16 cameras a 24-port model fits. For power, assume 12 W per fixed camera (typically 6 to 16 W): 16 × 12 = 192 W at the cameras, divided by 0.85 for cable loss is about 226 W, and with 20% headroom about 271 W at the switch, so you need a PoE budget of roughly 300 W or more. Camera ports can be 100 Mbps for typical cameras, but the switch's link to the NVR should be Gigabit, and if you need VLANs or remote monitoring, choose a Lite-Managed or managed model. KDT examples are the KP-1606J3SFT (16 PoE ports, 400 W) if you do not plan to expand, and the KP-2408H4SMU (24 Gigabit PoE ports, 600 W) if you do.

An unmanaged switch has no settings page and works as soon as it is powered on; it is enough for a simple single-subnet network, for example the KP-0804H4SF, whose AI functions are selected with DIP switches. A Lite-Managed (Smart) switch has a web page and provides the basics such as VLAN, QoS, port mirroring, port rate limiting and PoE on/off; the KP-0406H4SLMT is an example. A managed switch adds a console and CLI to the web page and is needed for security, several VLANs, monitoring and larger networks; in the KDT range, the KP-2408H4SMU (Layer 2) and the KP-2404H5SM3U (Layer 3) are managed through the web interface, console, Telnet and SSH. As a rule of thumb: choose unmanaged if you only need PoE and connectivity, Lite-Managed if you must separate or monitor the network, and managed if you need security and full control.

A Layer 2 switch forwards frames only by MAC address inside one network (VLAN), which is enough to connect the cameras, the NVR and the computers of a single subnet. A Layer 3 switch also routes between different VLANs and subnets (Inter-VLAN Routing) at hardware speed, and larger models add static and dynamic routing. You need Layer 3 when you have several VLANs that must talk to each other (for example a camera VLAN and a VMS server VLAN), when the number of subnets is large, or when the switch sits in the network core. If you have only one subnet, Layer 2 is cheaper and simpler, and routing can be left to a router or firewall. KDT Layer 3 examples are the KC-2800H5SM3, the KP-4806H5SM3 and Carbon-series models such as the KS-C24G-T-6YQ.

In KP models the first two digits give the number of PoE ports and the next two digits the number of other (uplink) ports; for example the KP-0804H4SF has 8 PoE ports and 4 other ports, and the KP-2404H5SM3U has 24 PoE ports and 4 uplink ports. Fast Ethernet means all ports are 10/100 Mbps; Semi Gigabit means the PoE ports are 10/100 Mbps and the uplinks are Gigabit (some models also have one or two Gigabit PoE ports); Full Gigabit means every port is Gigabit; and 10 Gigabit means the model has 10 Gbps uplinks. PoE+ means the 802.3at standard with up to 30 W per port, Hi-PoE means a model with ports of up to 90 W under 802.3bt (on some models only the first few ports), AI means smart functions set with a DIP switch such as VLAN, Extend and Watchdog, and Lite-Managed means simple management through a web page. The prefix KP identifies PoE switches, KC core switches without PoE, and KS-C the Carbon series for data centers.

IEEE 802.3af (also called PoE or Type 1) delivers up to 15.4 W at the port (PSE) and at most 12.95 W reaches the device (PD); IEEE 802.3at (PoE+ or Type 2) delivers 30 W at the port and 25.5 W at the device; and IEEE 802.3bt, which is also marketed as PoE++ or Hi-PoE, delivers 60 W at the port and 51 W at the device in Type 3 and 90 W at the port and 71.3 W at the device in Type 4. The difference between the two figures is the power lost in the cable resistance, about 15% to 21% in the worst case of a 100 m cable, so compare a camera's consumption with the device-side (PD) figure, not the port figure. Standards af and at use two pairs of wires, bt can use all four pairs, and in every case the switch first detects and classifies the device and only then supplies power.

The PoE budget is the total power the switch's power supply can deliver to all ports at the same time, and it is usually lower than the sum of the port limits; for example, the KP-2408H4SMU has 24 PoE ports (the first four up to 90 W) but its total budget is 600 W. To calculate it, add up the real consumption of all devices, divide by 0.85 as a conservative allowance for cable loss, and add 20% headroom for consumption peaks. Example: 12 fixed cameras at 10 W and 2 PTZ cameras at 25 W make 12 × 10 + 2 × 25 = 170 W at the devices; 170 ÷ 0.85 = 200 W, and with 20% headroom 240 W, so you need a switch with a budget of 250 W or more. If the switch reserves power by class, every Class 3 device occupies 15.4 W even if it draws less and every Class 4 device occupies 30 W (here 12 × 15.4 + 2 × 30 = 244.8 W), so also check the allocation method in the datasheet.

No. The port rating is only a ceiling and each device draws just what it needs, so an 8 W camera on a 90 W port still uses 8 W. According to KDT camera specifications, fixed and dome cameras typically draw about 6 to 16 W and work with standard PoE (802.3af) or PoE+ (802.3at), PTZ cameras often need 25 to 30 W from PoE+, and some explosion-proof cameras need up to 60 W under 802.3bt. Other power-hungry devices, such as cameras with heaters in cold climates or some access points, may also need more than 25 W, and only for those do you need an 802.3bt or Hi-PoE port. More important than the power of a single port are the total budget of the switch and the number of bt ports; in the KP-2408H4SMU, for example, only the first four ports supply up to 90 W.

A camera's power draw is not constant: at night the IR LEDs switch on, in cold weather the heater starts, and a PTZ draws more while it moves; for example, eight cameras that use 7 W each by day (56 W in total) reach 96 W at 12 W each at night. If the total exceeds the switch's PoE budget, or one camera draws more than its port limit, the switch protects itself by cutting power to one or more ports and the camera restarts, which is why the fault appears only at night or when a PTZ moves. Design for the maximum draw and leave at least 20% of the budget free, move power-hungry cameras to stronger ports or another switch and, if the switch has a web page, check the PoE status of the ports. A long or poor-quality cable also increases the voltage drop and causes the same symptoms.

Check three things in order: first, that the device really supports standard PoE 802.3af, 802.3at or 802.3bt rather than passive 24 V PoE or a 12 V-only input; second, that the power it needs does not exceed the port's power (a device that wants 25 W will either not start on a 15.4 W port or run with reduced features) and that the switch's total budget is not used up; third, that the cable is solid copper, all eight conductors are terminated correctly and it is shorter than 100 m, because CCA cable or a faulty connector can stop the power getting through. For a quick test, move the same camera to another port with a short, known-good cable and try a known-good PoE device on the suspect port; a PoE tester shows the voltage and class of the port and tells you how far the power gets. If the switch is Lite-Managed or managed, make sure PoE is not disabled for that port on its web page.

A non-PoE device such as a laptop, an NVR or a printer is not damaged: a standard PoE port first probes the device with a low voltage and connects the real power only if it sees the signature resistance of a PoE device (about 25 kΩ). Conversely, a passive PoE device (for example 24 V) does not get power from a standard port and needs its own injector, and you should never connect an always-on passive injector to an ordinary device because it can burn its port. A camera that only needs 12 V can be run with an active PoE splitter (802.3af or 802.3at input and 12 V output) or with a separate adapter, and the splitter's power rating should exceed the camera's consumption including IR. Standard PoE devices from any manufacturer work with a standard PoE switch because detection and classification are the same for all of them, and an older device (for example af) can be connected to a newer port (for example bt) and takes only the power it needs.

For PoE buy solid copper cable of Cat5e or better; Cat5e is enough for 802.3af and 802.3at devices, and for 802.3bt, which delivers 60 to 90 W, or when several heavily loaded cables run together in one route, Cat6 or Cat6A is better because it usually has thicker conductors and therefore lower resistance and less heating. CCA cable (copper-clad aluminum) is cheaper, but its electrical resistance is about 1.5 times that of copper, so the voltage drop and PoE heating are higher, it is brittle, and it is not accepted by the TIA-568 cabling standard; the result is a camera that restarts or gets no power even under 100 m. Before hiding the cable in a wall or conduit, check it with a cable tester to confirm the wiring of all eight conductors and the length.

A PoE injector powers only one device and sits between an ordinary switch and the device (data passes through it and power is added), so it is a good choice when you have only one or two scattered cameras or your existing switch has no PoE; every injector needs its own power outlet and adapter. A PoE switch is better for several devices in one place because it powers them all from one power supply, one UPS and one monitoring point, and it is usually tidier and more cost-effective. In both cases the total cable length from the switch to the device, including the cable between the switch and the injector, must not exceed 100 m, and the injector's standard (af, at or bt) must at least match the device's needs.

The Watchdog is a function with which the switch monitors the devices connected through PoE and, if a device stops responding, cuts and restores the power of that port; it is as if someone unplugged the cable and plugged it back in, without going to the site. In KDT AI PoE+ switches such as the KP-0403H2FT and KP-0803H2FT this function is on by default, and in the KP-0804H4SF it is switched on with DIP switch number 3, with no programming needed. The Watchdog only fixes faults that a restart cures, such as a camera or access point whose software has hung; if a device keeps restarting, find the real cause, such as the PoE budget, the cable or a faulty device. A Lite-Managed switch such as the KP-0406H4SLMT also offers PoE on/off management from its web page, so you can restart a device manually.

Copper cabling standards (IEEE 802.3, TIA-568 and ISO/IEC 11801) define a maximum of 100 m for 10BASE-T, 100BASE-TX and 1000BASE-T: 90 m of fixed cable plus at most 10 m of patch cords; beyond that, signal attenuation and PoE voltage drop cause dropouts and restarts. You have three practical options: put a PoE switch or extender midway so each segment stays under 100 m; use fiber with a media converter or an SFP module and provide local power or a PoE switch at the far end; or use the Extend mode of switches that have it, such as KDT's AI PoE+ series, to reach 250 m at 10 Mbps. For very long or outdoor runs, fiber is the most reliable choice, because it has no 100 m limit and, if it is non-metallic, it also breaks the path of lightning-induced surges.

In KDT AI PoE+ switches such as the KP-0403H2FT, KP-0803H2FT and KP-0804H4SF, turning on the corresponding DIP switch (number 2 on the first two models and number 1 on the KP-0804H4SF) extends the camera cable from 100 m to 250 m. According to the datasheets of these models, at 250 m the link runs at 10 Mbps, that is 10BASE-T, over Cat5 or better cable, while for 100 Mbps and 1 Gbps the datasheets list only about 100 to 120 m. This distance is beyond the IEEE 802.3 limit and depends on the quality of solid-copper cable, so always test it after installation with a tester or the real camera image. The other limit is power: the resistance of a 250 m cable is 2.5 times that of a 100 m cable, so a 12 W camera loses about 1.5 W in the cable at that distance and still works, but a 25 W device of the PoE+ type does not get enough power there; the camera's whole video stream must also fit in 10 Mbps.

These switches (such as the KP-0403H2FT, KP-0803H2FT and KP-0804H4SF) are unmanaged and Plug & Play: they have no web page or CLI, and you choose three smart functions with the DIP switch on the panel: VLAN for isolating the ports from each other, Extend to reach 250 m, and Watchdog to restart a hung device automatically. The switch numbers differ between models: on the KP-0403H2FT and KP-0803H2FT, switch 1 is VLAN and switch 2 is Extend, and Watchdog is on by default; on the KP-0804H4SF, switch 1 is Extend, switch 2 is VLAN, switch 3 is Watchdog and switch 4 is the 2.5G SFP option. So always read the label on the panel and the datasheet of your exact model, and note that each function applies only to the ports named in the datasheet.

Switching capacity is the sum of the speeds of all ports multiplied by 2, because every port sends and receives at the same time (full duplex). For example, 24 ports at 1 Gbps and 4 ports at 10 Gbps give 24 × 1 + 4 × 10 = 64 Gbps and 2 × 64 = 128 Gbps, which is the figure listed for the KP-2404H5SM3U; if the listed capacity is not lower than this figure, the switch is non-blocking and can pass all ports at full speed at the same time. The forwarding rate shows how the switch performs on small packets and is measured in Mpps, million packets per second: each 1 Gbps with 64-byte packets equals 1.488 Mpps, so the same port mix gives 24 × 1.488 + 4 × 14.88 ≈ 95.2 Mpps (the KC-2800H5SM3 lists 95.23 Mpps with this port mix, and that figure is one-directional). Some datasheets, such as the Carbon series, quote both figures bidirectionally, for example 408 Gbps and 607.1 Mpps, so compare only figures counted the same way; in CCTV systems the bottleneck is usually the uplink or the NVR port, not the switching capacity.

An uplink port connects the switch to the upstream device (the main switch, NVR, server or router), and because the traffic of all ports passes through it, it should be faster than the camera ports, usually 1 Gbps or 10 Gbps. An RJ45 uplink works over copper cable up to 100 m; an SFP port takes a removable module and, with the right module, covers longer distances, for example 1000BASE-SX up to 550 m over 50-micron multimode fiber and 1000BASE-LX10 up to 10 km over single-mode. An SFP+ port has the same size but runs at 10 Gbps, and a Combo port is one physical port shared between RJ45 and SFP where only one of them is active at a time; for example the KP-2408H4SMU has four Combo ports. If the switches are in separate buildings or more than 100 m apart, choose SFP with fiber and select the module and fiber as explained in the fiber optics topic; if several switches connect to one NVR or server, use 10 Gbps or two uplinks with LACP.

Yes: with Link Aggregation according to IEEE 802.3ad, which is now part of IEEE 802.1AX and whose protocol is called LACP, several cables appear as one logical link; two 1 Gbps links give about 2 Gbps of total capacity, and if one fails the other keeps working. Both ends of the link must support and configure aggregation, so it is usually not possible with an unmanaged switch. Traffic is spread across the links by a hash of the addresses, and each flow, for example one camera to the NVR, travels over a single link, so aggregation helps when the traffic of many devices passes over the uplink, and for more speed for a single flow you need a faster link, for example 10 Gbps. In the KDT range, the datasheets of the KC-2800H5SM3 and KC-3800H5SM3 list the 802.3ad standard, and the Carbon series supports up to 64 aggregation groups.

A VLAN divides one physical network into several logical networks using the IEEE 802.1Q tagging standard; the VLAN ID is a number from 1 to 4094 and a 4-byte tag is added to the frame. An Access port gives one VLAN, untagged, to a camera or a computer, and a Trunk port carries several tagged VLANs between switches and to an NVR or a router. In CCTV, keeping the cameras (for example VLAN 20) apart from the office network (VLAN 10) and the phones (VLAN 30) stops the cameras' broadcast and multicast traffic from reaching the computers and prevents office users from reaching the cameras without passing a router or firewall. Configurable 802.1Q VLANs need a Lite-Managed or managed switch (the KP-0406H4SLMT, for example, supports 802.1Q and Port VLAN), and traffic between VLANs is possible only through a Layer 3 device such as a router or a Layer 3 switch.

QoS tells the switch which packets to send first, or to drop if necessary, when a port or link is congested; so it only has an effect during congestion and changes nothing if the link is not busy. The switch classifies packets by 802.1p priority (three bits, a value of 0 to 7) or DSCP (for example EF, or 46, for voice), sends them through different queues, and can also limit the speed of a port (rate limiting). A common use is where IP phone voice or audio announcements share the same link as the cameras and office data and must not suffer delay or dropouts, or where an uplink has to be shared between several services. QoS is not a substitute for bandwidth, so first choose the link capacity correctly (for example a Gigabit uplink); in the KDT range, the KP-0406H4SLMT supports QoS and port rate control.

In multicast, one sender streams to a group of receivers using a destination address between 224.0.0.0 and 239.255.255.255, but a switch without IGMP Snooping delivers it to all ports of the VLAN like a broadcast; for example 32 cameras multicasting at 4 Mbps each means 128 Mbps on every port, which saturates 100 Mbps ports and Wi-Fi access points. With IGMP Snooping the switch listens to the membership messages (IGMP Join) and gives each group only to the ports that asked for it. Every VLAN needs an IGMP Querier, that is a router, a Layer 3 switch or the switch itself, so that memberships stay fresh, and an unmanaged switch usually does not have this function. If the cameras send only unicast, such as ordinary RTSP, IGMP Snooping is not needed; in the KDT range, the Carbon series includes IGMP Snooping in its base license.

When more than one path is connected between two points of the network, for example a patch cord joining two wall sockets or two ports of the same switch, broadcast packets circulate endlessly and fill the links within seconds; the signs are all the LEDs blinking rapidly and the whole network stopping. STP (IEEE 802.1D standard) and its faster version RSTP (802.1w standard) keep the extra paths blocked and activate them only when the main path fails; STP can take 30 to 50 seconds to recover in the worst case, while RSTP usually takes about one to a few seconds or less, so enable RSTP. Set the ports that connect to cameras and the NVR as Edge Port or PortFast so they come up immediately after being connected, turn on BPDU Guard on those ports so that a port is blocked if an extra switch is plugged in, and use Storm Control and Loop Protection where available. An unmanaged switch usually has no STP, so be careful when cabling; if a broadcast storm occurs, unplug the cables one by one until you find the faulty link. In the KDT range, the datasheets of the KC-2800H5SM3 and KC-3800H5SM3 list the 802.1D, 802.1w and 802.1s standards, and the Carbon series supports STP, RSTP and MSTP.

Combine several layers: first, disable unused ports and keep the cameras in a separate VLAN. Second, enable Port Security on the camera ports so that only the permitted MAC address (or at most one or two MAC addresses) is learned and the port is blocked when an unknown MAC appears. Third, if the cameras support 802.1X, use 802.1X authentication with a RADIUS server, and for cameras that do not, use MAB, that is MAC Authentication Bypass, but remember that MAB can be fooled by copying a MAC address. Also restrict management of the switch itself with HTTPS or SSH and, where possible, an allowed IP list. In the KDT range, the KP-2408H4SMU and KP-0406H4SLMT offer features such as Port Security, Access IP List, 802.1X MAB and HTTPS.

Port Mirroring (or SPAN) on a switch sends a copy of the incoming and outgoing traffic of one or more ports to another port; you connect a laptop running Wireshark to the destination port and see the packets without disconnecting the camera or the NVR. On the Port Mirror page you choose the source port (for example a camera port or the NVR port) and the destination port; in the KDT range, the Lite-Managed KP-0406H4SLMT offers Port Mirror. While you analyze, the destination port is used only for capture and carries no normal traffic; if the combined traffic of the sources exceeds the speed of the destination port, packets are lost (for example two busy 1 Gbps ports mirrored to a 1 Gbps destination). An unmanaged switch usually does not have this function.

An industrial switch is built for places where temperature, vibration, dust and electrical noise are worse than in a server room: a sturdy metal housing, DIN-rail mounting, a much wider operating temperature range, dual redundant DC power inputs and better protection against noise and surges. For example, most ordinary KDT Platinum switches are specified for -15 to 50 °C, whereas the industrial models KP-0402H4SMIUH and KP-0804H5SMIUH, with an aluminum housing and DIN-Rail mounting, are built for -40 to 80 °C and two power inputs of 48 to 54 V DC. Choose industrial for electrical panels, containers, pump houses and outdoor cabinets without ventilation; for a rack room or an office building an ordinary switch is enough and cheaper. Size the DC power supply from the PoE budget with 20% headroom and connect two independent supplies to the two inputs, so the switch keeps running if one fails.

In a ring topology the switches are connected in a circle so that if one cable breaks, traffic reaches its destination the other way around; but a ring without a protocol causes a loop and a broadcast storm, so a protocol must keep one of the links blocked and open it when something fails. RSTP, the IEEE 802.1w standard, is available in almost all managed switches, but its recovery time depends on the size of the ring and is usually from a few hundred milliseconds to a few seconds. ERPS, defined in ITU-T G.8032, is designed specifically for Ethernet rings and aims to recover in about 50 ms or less, which matters for live video and industrial control without noticeable interruption; all switches in the ring must support ERPS. In the KDT range, the datasheet of the Carbon series, for example the KS-C24G-TP-6YQ, lists ERPS with recovery under 50 ms and RSTP and MSTP with recovery under 1 s, and the multi-ring mode of ERPS needs an optional license.

Lightning usually damages equipment by inducing voltage on outdoor cables, not only by a direct strike, and the network cable is one of the paths it enters by. Protection has several layers: a PoE-rated Ethernet surge protector (SPD) at both ends of any cable that leaves the building, that is next to the camera and near the building entry or the switch; a short, thick earth wire from the protectors to one common grounding system so that no potential difference appears between equipment; and, where possible, non-metallic fiber between buildings, which closes the path for induced voltage. The switch's own internal protection, which some datasheets quote as an IEC 61000-4-5 surge test level, is not a substitute for an external protector, and the protector must be compatible with the PoE type in use, that is af, at or bt. Also install the switch with proper grounding and on power with surge protection or a UPS.

First look at the link and PoE status of the port: if the link or the port's power keeps dropping and returning, the problem is the power, the cable or the connector; if the link is stable but the picture stutters, look at the network, the uplink and the settings. If the switch shows port statistics (Lite-Managed and managed models), check the CRC or FCS error counter; a rising number means the cable, connector or wiring is faulty. Three quick tests: move the same camera to another port with a short, known-good cable, connect a known-good camera to the suspect port, and compare the total PoE power drawn with the switch's budget (especially at night when the IR switches on). If all the cameras drop at the same time, suspect a loop, STP or a saturated uplink, and a cable tester or PoE tester that shows length, wiring and voltage speeds up the work.

Yes. Ethernet switches have no fixed limit on how many can be chained (the old 5-4-3 rule applied only to hubs and shared-media networks), and each cable between two switches must stay under 100 m. The real limits are uplink bandwidth and PoE budget: every link carries the traffic of all the cameras behind it, so with the NVR on the first switch and four chained switches of 16 cameras at 4 Mbps each, the link between the first and second switch carries 48 cameras, 48 × 4 = 192 Mbps, which is easy on a 1 Gbps link but impossible on a 100 Mbps link. Every switch has its own PoE budget and power supply. In practice keep the chain short (three or four switches is a common rule of thumb, not a standard) or connect each switch to a central one in a star, because the failure of a middle switch or link cuts off every switch behind it; for more resilience use a ring with RSTP or ERPS.