Ports 13 and 14 in that switch had been dead for three weeks when I got to the site. No link, no PoE, nothing in the log. The integrator had already replaced both cameras and both patch cords, and had started telling the customer the switch was faulty. I put a meter on an empty port and watched it twitch about twice a second — a couple of volts, then nothing, then a couple of volts again. The switch was fine. It was asking a question and getting the same wrong answer every time.
The short version: a PoE port will not put 48 volts on a cable until it has measured roughly 25,000 ohms at the far end. Not "a PoE device". A resistor. Everything people talk about afterwards — the class, the wattage, the LLDP conversation — happens only after that one measurement passes. If a port pulses and never latches, you have a resistor problem, a leakage problem, or a device that was never a PD. On a standard PoE switch, the switch itself is the last thing to suspect and the first thing to get blamed.
What the port does before 48 V appears
Inside the PSE there is a small current source and a comparator, and before every power-up the port runs a fixed sequence with them. It applies a low probe voltage across the pair, between 2.7 and 10.1 volts. Then a slightly different one, and measures the current again. Two voltages, two currents, one division: what comes out is the resistance of whatever hangs on the other end of the cable. The current is tiny, about 108 µA at 2.7 volts through 25 kΩ, because this is an identity check and not a power measurement.
If the answer lands inside the accepted window — PD tolerance is roughly 19 to 26.5 kΩ, and many PSEs are stricter, looking for something near 23.75 to 26.25 kΩ — the port moves on. If not, it backs off for a few hundred milliseconds and tries again. That retry loop is the twitch on your meter, and it is the most useful diagnostic signal on the whole installation. A port that pulses is a healthy port getting a bad answer. A port that sits at zero and never pulses has a disabled port or a dead controller.
25,000 ohms is the whole handshake, and it is easy to break
The signature is not a resistor soldered across a spare pair. In a compliant PD it sits behind a bridge rectifier, so the port finds the same 25 kΩ whichever way the pairs are wired, and the PD's own controller switches it in and out of circuit. That bridge is where a lot of field failures live.
I keep a cardboard box in the lab with twenty-odd cameras and APs that customers returned as "no PoE". Nine of them had a blown bridge. From the switch side all nine looked identical: probe, open circuit, retry forever. They booted fine on a bench supply through the barrel jack, which is why the integrator kept insisting the cameras were good. They were good. They just could not answer.
The second mode is a PD that implements half the standard. I have opened cheap cameras where the signature resistor sat directly across one pair with no bridge at all, so the device works on one pinout and silently fails on the other. Straight-through versus crossover, Alternative A versus Alternative B, and a camera that worked on the bench does nothing in the ceiling.
The third has nothing to do with the PD. A 24-volt passive camera, a plain IP camera on a 12-volt adapter, an old analogue balun — none of them present a signature, and no configuration will make a standard PSE power them. Those runs need the conductor conversation instead, where the CCA-versus-copper question starts to bite.
Why "the cable is too long" is usually the wrong suspect
I got this wrong for two years, in writing, in a report a customer paid for. A run at 95 metres would not power a camera, a 20-metre test lead in the same port worked, so I wrote that the cable's DC resistance had pushed the signature out of band. It sounded plausible. Half the articles on this subject repeat it.
It cannot happen. Twenty-four gauge copper is about 9.38 Ω per hundred metres per conductor, so a hundred-metre loop through one pair is roughly 18.8 Ω. In series with 25,000 Ω that moves the reading by 0.075 percent. The accepted band is plus or minus five. The cable would need to reach about 1,250 Ω before series resistance alone could fail detection, and at that point it is not a cable any more.
What does fail at 95 metres is leakage, settling time, or a PD that was marginal to begin with. Leakage is the one I find most often, because it does not add to the signature — it divides.
| Parallel leakage path | What the port measures | Result |
|---|---|---|
| None (dry, healthy) | 25.0 kΩ | Detection passes |
| 200 kΩ (damp, not wet) | 22.2 kΩ | Passes, but near the edge |
| 100 kΩ (water in the boot) | 20.0 kΩ | Marginal. Some PSEs accept, most do not |
| 60 kΩ (standing water, salt air) | 17.6 kΩ | Fails. Port retries forever |
| 33 kΩ (corroded pins, gel gone) | 14.2 kΩ | Fails. Often misread as a shorted PD |
| Open circuit | > 1 MΩ | No PD: passive device, blown bridge, cut pair |
Note how little it takes. A hundred kilo-ohms across a pair is not a short by any normal standard. A continuity tester never flags it, an insulation test at 500 volts reads something perfectly respectable on a dry afternoon, and the camera will not power. That is why the meter in your bag says the cable is fine and the port disagrees.
Capacitance is the narrower story. A hundred metres of Cat5e is about five nanofarads, a PD front end adds a tenth of a microfarad, and the port has a fixed window in which the probe voltage must settle before it samples. Intermittent detection at long range, rock solid at short range, is a timing symptom rather than a resistance one. I have fixed it twice by replacing the switch and once, embarrassingly, by replacing a PD whose input capacitance had gone out of spec.
Classification: the resistor that answers "how much"
Once identity is settled the port asks a second question, and the PD answers with another resistor. The PSE raises the pair to somewhere between 15.5 and 20.5 volts, the PD clamps that to about 12.5 volts across its class resistor, and the current tells the port which class it is talking to. Roughly: class current equals 12.5 volts divided by the class resistor.
| Class | Nominal class current | Class resistor | PSE reserves | PD gets |
|---|---|---|---|---|
| 0 | under 5 mA | none / open | 15.4 W | 12.95 W |
| 1 | 9.5 mA | 1.3 kΩ | 4.0 W | 3.84 W |
| 2 | 18.1 mA | 690 Ω | 7.0 W | 6.49 W |
| 3 | 27.8 mA | 450 Ω | 15.4 W | 12.95 W |
| 4 | 41.7 mA | 300 Ω | 30.0 W | 25.5 W |
12.5 divided by 300 gives 41.7 mA, comfortably inside the 36 to 44 mA band the standard assigns to Class 4. And the 4.5-watt gap between the 30 W reserved and the 25.5 W allowed is not abstract margin. It is copper: 600 mA through a 12.5 Ω channel comes to 4.5 W.
Two consequences. A PD with no class resistor reads Class 0, which is not an error, just the smallest envelope the port can offer — worth checking before blaming a power supply. And classification requests an envelope rather than declaring consumption: sixteen Class 4 cameras drawing 6 W each will exhaust a 370-watt switch at twelve ports with under 80 watts of real load on the box. That is the same accounting that makes power budget maths look wrong on paper.
Two events, five fingers, one dark radio
Class 4 created a problem. A Type 1 PSE only knows classes 0 to 3, so what happens when a 30-watt access point lands on an old 15.4-watt port? Nothing dramatic, which is the confusing part. The AP boots. It associates clients. And the second radio never comes up.
The mechanism is a second classification probe. A Type 2 PSE measures class twice in quick succession, and a compliant Class 4 PD watches for that second probe. See two and it may draw the full 25.5 watts. See only one and it must assume a Type 1 port and hold itself to 12.95 watts. No error, no refusal to boot, just one radio. I lost most of a day to that on a floor where half the APs had a 6 GHz radio: same model, same firmware, same config. The only visible clue was the reserved wattage, 15.4 against 30.0. There is a budget-side version of the same trap, and it bites the same way.
802.3bt extends this rather than replacing it. A Type 3 or Type 4 PSE sends up to five class fingers, and a bt PD carries two class resistors so the port can read a coarse class and then a finer one. The tiers run to 60 W at the PSE for Type 3 and 90 W for Type 4, with 51 W and 71.3 W available at the PD. Some bt ports also re-allocate on measured draw after startup instead of the declared class — but only if the firmware implements it.
None of it replaces the physical layer. LLDP power negotiation is real, but it runs after the port is already powered and can only ask for less than the class envelope, never more. If the class resistor says Class 3, no message conjures a bigger allocation out of a port that never reserved it.
Six steps I run on a port that powers nothing
This is the order when I get called to a dead PoE site. Not clever, but it converges, because each step removes one variable instead of adding two. It is the electrical half of the checklist I run first.
- Measure the empty port. Expect near zero with a slow twitch. A steady 48 to 54 volts means forced mode, so stop and read the switch config. No twitch at all means the port is disabled or the PSE channel is dead.
- Insulation-test the run with both ends disconnected. 500 volts, pair to pair, then pair to shield. Hundreds of megohms is normal. A few hundred kilo-ohms is water, and no switch swap will fix it.
- Plug in a signature plug or a tester emulating a PD. A 25 kΩ one-percent resistor across the pair, through a bridge, is enough. If the port powers the plug, the PSE and cable are exonerated and the PD is guilty.
- Expect the port to drop it again. A resistor draws about two milliamps at 50 volts. The maintain-power signature wants ten milliamps for at least 75 milliseconds, so power is cut after a few hundred milliseconds. Correct behaviour, not a second fault, and the reason a bare resistor cannot hold a port open for a load test.
- Emulate a class and read the reserved wattage. Set the tester to Class 4 and watch the port allocation in the interface. Still 15.4 watts? The PSE is not doing two-event classification, and you have found why the AP runs on one radio.
- Change one thing at a time. Known-good PD on the suspect port, suspect PD on a known-good port. I once swapped a camera and a patch cord together, then spent an hour explaining why the fault had moved with neither of them.
Twenty minutes with a tester that emulates signature and class.
Questions that come up on site
Can I damage a laptop by plugging it into a PoE port?
Not on a compliant port. No signature means the port never leaves detection and never applies 48 volts. The devices that do cause damage are passive injectors and switches in forced mode, which push power out unconditionally. If you inherit an installation where someone has been making PoE work with passive injectors, that is the risk.
Why does my camera work on a passive injector but not on the switch?
Because it is probably not a PD. It expects 12 or 24 volts on the pair and has no signature resistor, no bridge, no class circuit. A passive injector does not ask questions. A standard PSE does, gets silence, and correctly refuses. Forcing 48 volts into such a camera usually destroys its input.
Why does the port power cycle every few seconds?
Detect, power, drop, retry. Either the PD is rebooting and losing its maintain-power signature, or it draws under ten milliamps and the port decides it was unplugged. Cameras with a failed IR driver and slow-booting devices both produce it. So does a resistor-only test load, which is why step four matters.
Can I put a splitter in line to extend detection?
The splitter is itself a PD. The port detects and powers the splitter, and the camera behind it is invisible at the physical layer. That is fine when the splitter is compliant and rated correctly, but it is a second handshake with its own failure modes, repeating every time the port retries.
Does a longer cable make detection less reliable?
Not through resistance. Through capacitance and settling time, at the margins, on PSEs with a lazy sample point — yes. If a device detects at 30 metres and not at 95, test the insulation first, the PD second, the switch third. Replacing the switch is the expensive guess, and usually the wrong one.
What I like about this corner of PoE is that it is one of the few things in networking you can fully verify with a resistor and a meter. No capture to read, no log to interpret, no vendor quirk to work around — the port either finds its 25,000 ohms or it does not, and the reading tells you which. Most installations I get called to have a clean answer hiding in that one number, usually underneath a replaced camera and a replaced patch cord. If you are chasing one right now, start at step two. It is the step people skip, and it is the one that finds the water.