802.3af about 15 W at the port, 802.3at about 30 W, and 802.3bt up to 60 W or 90 W depending on type - with the device always receiving less than the port supplies.

The gap between the two figures is cable loss. The standards specify power at the port and the guaranteed minimum at the far end, and the difference grows with cable length and with poorer cable. Over a long run the loss is significant, which is why a device rated close to its class limit can misbehave at 90 m and work perfectly on the bench.

802.3af and 802.3at use two of the four pairs. 802.3bt uses all four, which is why it can deliver so much more and why it requires cabling with all four pairs terminated correctly - a real constraint in older installations where only two pairs were used.

Devices and switches negotiate class, so a switch supplying more than a device needs is harmless. A switch supplying a lower class than the device requires leaves the device either dead or, worse, intermittently rebooting under load.

Add the real draw of every device, use peak rather than typical, add cable loss, then leave headroom - and compare against the switch's total budget, not its per-port rating.

Start with the device data sheets. A fixed dome camera might draw 6 W; the same camera with a heater and a motorised lens might peak near 30 W in cold weather, and it is the cold morning that matters.

Access points vary by radio configuration - a tri-band unit running all radios at full power can exceed 25 W - and some reduce functionality silently if given less.

Add cable loss for the longer runs, then add headroom of at least a quarter for growth, because the devices added later tend to be the hungry ones.

When the budget is exceeded the switch sheds ports by priority, or by port number if priority is not configured. The symptom is a device that works until another one is plugged in somewhere else, which is a genuinely confusing fault.

On a managed PoE switch, yes - and it is often the single feature that justifies choosing managed over unmanaged.

Disabling and re-enabling power on the port cuts the device's supply and restores it, which is a full power cycle. For a camera on a mast, an access point above a ceiling or a door controller in a locked riser, that turns a site visit into a thirty-second action.

Many switches will also do it automatically. A PoE watchdog pings the powered device and cycles the port if it stops responding, which recovers the common case of firmware hanging without anyone being involved at all.

Two cautions. Some devices dislike abrupt power loss - notably anything writing to local storage, such as a camera with an onboard card - so use the device's own reboot where available and reserve the port cycle for when it is not reachable.

And set the watchdog target carefully: pointing it at an address that legitimately stops responding produces a device that reboots forever.

Yes. Higher-power PoE heats the cable, and bundling makes it worse - which affects installation practice more than component choice.

Current flowing in the conductors produces heat. In a single cable it dissipates easily. In a tight bundle of a hundred cables all carrying high-power PoE, the ones in the middle cannot lose heat and rise well above ambient.

That matters because insertion loss increases with temperature, so a cable that passed certification cold may not meet its performance warm. Cabling standards therefore de-rate the maximum length for cables in large bundles carrying high-power PoE.

The practical measures are to keep bundle sizes moderate, avoid running high-power PoE through hot voids, and prefer larger conductor gauge on long runs since it both loses less power and generates less heat.

Also ensure all four pairs are properly terminated. 802.3bt needs them, and older installations terminated on two pairs cannot carry it at all.

A switch powers many ports centrally; an injector adds power to one existing link. The choice is about scale and about where the failure lands.

A PoE switch is the right answer wherever several powered devices converge - it is one device to manage, one power feed, one place to put a UPS, and it gives per-port monitoring and remote cycling.

An injector suits the single awkward device: one camera at the end of a run from a non-PoE switch, or one access point that needs more power than the switch can give it. It is cheap and immediate.

The drawbacks of injectors are operational. Each is a separate power supply in a separate place, usually unmonitored, and they accumulate. A rack with fourteen injectors and their power bricks behind it is a recognisable sign of a network that grew rather than being designed.

Injectors also add two connections to the link, which is two more points of failure on a run that may already be near its length limit.

Roughly the difference between what the switch draws and what it delivers, plus the switch's own consumption - which on a fully loaded high-power switch is enough to need planning for.

A switch delivering 700 W of PoE is drawing appreciably more than that from the mains, and the difference - conversion losses - becomes heat inside the cabinet. The power that leaves down the cables becomes heat elsewhere, but the conversion loss stays.

In an open comms room that is usually absorbed. In a small sealed wall cabinet it is not, and the result is a switch running near its thermal limit, fans at full speed, and a shortened life for everything in the enclosure.

Check the switch's stated heat dissipation figure against the cabinet's ventilation. Where cabinets are enclosed, fan units or a larger enclosure are cheaper than the equipment failures.

Also size the UPS on total draw including PoE. A UPS sized for the switch alone will not carry the cameras it powers.

Budget exhaustion, class negotiation failures, cable faults that pass data but not power, and devices that reboot under load.

Budget exhaustion presents as a device elsewhere losing power when a new one is connected. The switch's PoE status page shows it immediately, and it is invisible without one.

Negotiation failures leave a device unpowered or powered at a lower class than it needs. Older devices and pre-standard equipment are the usual culprits, and some switches offer a forced or legacy mode for them.

Cable faults are the interesting case: a run with one bad pair may still carry gigabit data by falling back, while failing to deliver four-pair power. So a device that has a link but no power is a cabling fault more often than a switch fault.

Devices rebooting under load - a camera that restarts when its heater or infrared illuminator engages - is nearly always insufficient power at the far end rather than a faulty device, and it appears seasonally, which delays diagnosis.