IP cameras take power and data down one cable and send a continuous stream to a recorder. That makes the network the part of the system most likely to be undersized, and most likely to be left insecure.
PoE switches and power budget
Power over Ethernet delivers power and data over the same cable. Two details decide whether it works.
The standard. Standard PoE (802.3af) supplies up to about 15.4 watts at the switch port, of which roughly 12.95 watts reaches the camera. PoE+ (802.3at) raises that to about 30 watts at the port. Most fixed cameras are comfortable on standard PoE. Cameras with heaters, white light illuminators, or pan-tilt-zoom motors often need PoE+.
The total budget. A switch quoted as "8-port PoE" may have a total power budget well below eight times its per-port maximum. Eight cameras at 12 watts need around 96 watts plus losses, so a 60-watt budget will brown out some of them — typically at night when the infrared turns on and demand jumps. Work out the real total, then allow headroom.
Also check whether the recorder's built-in PoE ports are being used — convenient, but they put cameras on the recorder's private network, which complicates analysis and remote access — and whether the switch is managed, which you need for VLANs.
Cabling runs and their limits
Ethernet over copper is rated to 100 metres total, including patch leads at both ends. Beyond that, expect intermittent dropouts rather than a clean failure, which makes it a miserable fault to diagnose months later.
For longer runs the options are:
- A PoE switch in a mid-point cabinet, so each leg stays under 100 metres.
- Fibre to a remote switch, which is the right answer for a separate shed, gate house or far corner of a yard.
- PoE extenders, which work but add a point of failure and often halve available bandwidth.
Use solid-core Cat6 for permanent runs, cross mains power rather than running parallel to it, and use UV-stable cable where it is exposed. Weatherproof the joints: water travelling down a cable into a housing is a common cause of failures that look electrical.
Ask for the runs to be labelled at both ends and recorded on a plan. Our installer questions guide lists the documentation worth insisting on.
Keep cameras on their own network
Cameras are embedded devices that often run old firmware and rarely get patched. They should not sit on the same flat network as your accounts machine.
A separate VLAN, or at minimum a separate physical switch and subnet, gives you:
- Camera traffic off the office network, so a dozen streams do not interfere with everything else.
- A boundary if a camera is compromised, since it cannot reach your file server or point-of-sale.
- Rules allowing only what is needed: cameras talk to the recorder and the analysis server, nothing else.
Change every default password. Factory credentials on cameras and recorders are published, searched for, and used.
How much bandwidth do you actually need
Internally, the load is high but local. Ten 4MP cameras at 4 Mbps is about 40 Mbps crossing the switch to the recorder — trivial for gigabit hardware, and the reason cameras and recorder belong on the same switch where possible.
Over the internet, only what you send out matters, and Australian business connections usually have far less upload than download.
| Activity | Rough upload needed |
|---|---|
| Email alert with a still frame attached | Negligible, a fraction of a megabit |
| Short event clip uploaded after an alert | A few megabits for a few seconds |
| Remote viewing on a phone (substream) | Roughly 0.5 to 1.5 Mbps per camera |
| Remote viewing full stream | The camera's full bitrate, 2 to 10 Mbps each |
| Continuous cloud upload of all cameras | The total of every camera's bitrate, constantly |
That last row is why cloud-only recording is impractical for most multi-camera sites, and why the pattern that works is: record locally, send small things out. Our own alerting does that — a sweep checks the cameras and emails a frame to the people you nominate, so the outbound traffic is an email, not a feed. Sizing the local side is covered in the storage guide and the storage planner.
When viewing remotely, use the camera's substream; most apps do by default. Pulling four full 4K streams to a phone will stutter and slow everything else in the building.
Remote access without exposing the recorder
This is the most important paragraph on this page. Do not port-forward your NVR to the internet. A recorder with its web interface facing the world will be found within hours by automated scanners. Default or weak passwords, unpatched firmware and old protocols on these devices are routinely exploited, and the result is someone else watching your site, or your recorder being used as a foothold into your network.
Safer approaches, roughly in order of preference:
- A VPN into the site. You connect to the network first, then the recorder, which stays invisible from outside. Usually configured on the business router or firewall.
- A reverse proxy or broker you control, terminating HTTPS with proper authentication, rather than publishing the recorder itself.
- The manufacturer's own cloud relay (P2P), which avoids open ports but means trusting the vendor's service with access to your cameras. Check where that service is hosted and keep the firmware current.
In our platform, footage stays on your recorder and analysis runs on our own server rather than a third-party cloud. Live viewing is served through a local restream, so the recorder is not hit by every viewer and never needs to be published to the internet.
A short pre-handover checklist
- Switch power budget measured against actual camera draw, including at night.
- Every run under 100 metres, labelled, and shown on a plan.
- Cameras on their own VLAN or subnet, with default passwords changed.
- A written record of admin credentials, held by you — not only by the installer.
- Remote access by VPN or a controlled service, with no port forwarding to the recorder.
- Remote viewing tested on substreams over the real connection, not on site Wi-Fi.
- Recorder and switch on a UPS, so a brief outage does not interrupt recording or corrupt a drive.
If you would like this specified properly for your site, ask for a quote. We work on the Gold Coast, Brisbane and South East Queensland, and support sites in other locations with remote setup and partner installers.