A single-port PoE injector is the right answer when exactly one device needs power, the existing switch cannot be replaced, and nobody is going to log into that link again. It becomes the wrong answer the moment the device needs more than 30 W, or the moment someone has to power-cycle it from another city. Everything else — price, rack space, brand — is a detail next to those two conditions.
Two weeks ago I spent a morning in a telecom cupboard in an office block last wired in 2013. Six fixed cameras, one 24-port switch with no PoE on it, and a facilities manager who would not sign off on replacing a switch that "still works fine". We put six injectors on the wall, labelled both ends of every lead, and were out before lunch. The week before, a different site: one Wi-Fi 7 access point, one "60 W" injector bought online, and an AP that booted happily, served clients at idle, and dropped every laptop in the room the second both radios went to full power. Same category. Opposite outcomes. The gap was in what the injector could negotiate, not what its box promised.
Two devices, two different jobs
A PoE switch is an endspan PSE. Power supply, PHY and port controller live in one chassis, share one budget, and usually report per-port current to something you can query. A single-port injector is a midspan PSE: it sits between a non-PoE switch port and the device, takes mains on one side and adds DC on the other, leaving the data path untouched.
Mechanically that costs one extra patch cord per device and one extra mains outlet per device. Electrically it gets more interesting. On a 100 Mbps link the injector can use the spare pairs, 4/5 and 7/8, and never touch 1/2 and 3/6. On Gigabit all four pairs carry data, so the injector has to superimpose DC onto the same conductors through centre-tapped magnetics. That is normal engineering. It is also why a cheap injector can be honest about voltage and quietly dishonest about pairs.
Both device types run the same handshake before they send real power: a limited voltage across the pairs, a hunt for the 25 kΩ signature (accepted window 23.75–26.25 kΩ), classification pulses, then the full operating voltage. A passive injector skips all of that and puts 48 V or 56 V on the line regardless of what is plugged in. I keep one on the bench for testing splitters. I would not put one above a ceiling.
Where the brick genuinely wins
Three situations, and I have stopped arguing with any of them.
One device, existing network, no capital approval. A camera added to a warehouse corner. A door controller in a leasehold building where the landlord owns the switch. An injector is a purchase order for one item. A switch replacement is a change request and a signature you may not get this quarter.
The switch budget is already spent. This is the case people miss. Eight devices at 25.5 W need 204 W of allocation. A 24-port switch with a 120 W supply cannot do that, no matter how many free ports it has — it will refuse the fifth PD, or worse, brown out the ones already running. Eight injectors share no budget at all; each is its own supply. Ugly, but it works, and I have used it as a stopgap while a replacement sat in an approval queue.
You need to isolate a fault. An injector on a known-good link removes the switch from the equation in thirty seconds. A fair number of the "the switch won't power my camera" calls I get end with an injector proving the switch was fine, and the real fault was a wet connector eighty metres away. There is a nine-step checklist for that, and none of it involves the injector.
Four ways an injector fails quietly
1. It only powers two pairs. 802.3bt Type 3 (60 W at the PSE, 51 W at the PD) and Type 4 (90 W and 71.3 W) are four-pair standards. A midspan that only energises two pairs cannot implement Class 5 through Class 8, whatever the label says. It falls back to 802.3at Class 4 and 25.5 W of PD power. The device still boots. It fails under load, an hour later, in a way that looks like a firmware bug. This is the failure from the opening paragraph, and I spent two days blaming the AP's radios before I put a clamp meter on the injector output and watched it flatten at 0.6 A.
2. Heat. These are plastic boxes with an electrolytic capacitor inside, and installers mount them wherever the cable goes — above a ceiling tile, behind a TV, on top of a cabinet. I logged 58 °C on the case of a 30 W unit in a riser at 41 °C ambient. Nothing failed that day. Electrolytics never fail that day; they fail in year three, and the symptom is a voltage sag under load that a bench test at 22 °C will not reproduce. If an injector has to live somewhere hot, derate it or move it into the rack.
3. No telemetry, no remote reset. A managed switch tells you a port is drawing 6.2 W on a camera that should draw 11 W, and that number points straight at a corroded connector. An injector tells you nothing. And when the device hangs, somebody drives to site to pull a barrel jack. On a site two hours away, that one property outweighs the switch's price.
4. Nothing upstream protects the device. An injector plugged into a wall outlet sits outside the rack UPS unless you planned for it. A camera on an injector dies in the first minute of a power cut while the NVR on the rack UPS keeps recording an empty scene. If ride-through matters, the injector goes on the UPS too, and now you are counting outlets instead of ports.
Reading the label that would have told you
Four things, in this order.
Voltage, standard, pairs. "56 V, four-pair, 802.3bt Type 4" is a specification. "PoE++, 90 W" is a wish. If the datasheet does not name the standard and the pair count, assume 2-pair 802.3at behaviour and design around it. Our breakdown of the af, at and bt standards carries the class table if you need a specific number.
Active or passive. Passive units have no detection and no negotiation. They will put 48 V into a splitter feeding a 12 V device and destroy it, and I have replaced two of those this year. Active only, unless you deliberately power passive gear and have checked the pinout yourself.
The derating curve. Any honest datasheet has one. A unit rated 30 W at 25 °C is often rated 22 W at 50 °C. No curve means the headline number came off a bench at room temperature.
Surge and isolation. Outdoors, the injector is usually the first thing a surge reaches. I want a documented clamping voltage, not "lightning protection" in a bullet list. The run still wants an arrester at the building entry; that is a separate subject.
Injector against switch, on the things that decide it
| Question | Single-port injector (midspan) | PoE switch (endspan) |
|---|---|---|
| Per-port output | 15.4 W (af) or 30 W (at) on 2 pairs; 60 W / 90 W only if all four pairs are energised | Same standard limits, applied per port with the pair count fixed by design |
| Shared budget | None. Each unit is an independent supply | One supply for all ports; allocation is refused, not oversubscribed |
| Per-port telemetry | Usually none; a few SNMP models expose current | Current, class and fault state, if the switch is managed |
| Remote power cycle | Only on managed units with a relay; rare | Standard: bounce the port from a browser |
| Wiring and AC | Two patch cords and one outlet per device | One patch cord per device, one outlet for the rack |
| Typical failure | Capacitor ageing, silent 2-pair ceiling, unit cooked in a riser | Budget exhausted, one dead PSE controller, fan clogged |
| Fits | 1–3 devices, legacy switch, temporary or isolated link | 4 or more devices, or any device someone will manage remotely |
The arithmetic I run before choosing
Six steps, on paper, in the van. Four minutes, and it has saved me a second visit more than once.
- Read the device label, not the box. Two numbers matter: the IEEE standard and the maximum draw. A camera marketed as "PoE" that carries a 26 W heater is an 802.3at device and will not run on af, no matter what the shop page says.
- Add 15 % headroom. Inrush plus the fact that PD draw climbs as the unit warms up. 25.5 W becomes 29 W.
- Multiply by device count. Six cameras at 12.95 W with headroom comes to roughly 89 W of allocation.
- Compare against the switch's PoE budget, never its port count. If the number does not fit, the choices are injectors, a second switch, or a smaller device. There is no fourth option that costs less.
- Do the cable sum. The 100 m channel includes both patch cords. The standard's channel model uses 12.5 Ω for that link; a clean 24 AWG run measures nearer 9–10 Ω cold, and copper at 60 °C sits about 15 % above its 20 °C value. At 600 mA, 12.5 Ω costs 7.5 V and 4.5 W — which is precisely the gap between 30 W at the PSE and 25.5 W at the PD.
- Ask who power-cycles it. "A technician, eventually" means an injector is fine. "Nobody, and it is four hours away" means it is not.
Worked through on the cupboard job: six 802.3at cameras, 6 × 29 W = 174 W of allocation. That switch had no PoE at all, so step 4 was settled before I started: six 30 W injectors, six outlets, twelve labelled patch cords. A week later, a Wi-Fi 7 AP at Class 6 wanted 51 W at the PD — 60 W at the PSE, four pairs of copper. A 2-pair injector could not have done it at any price.
What I do now
Default: a PoE switch, sized on allocation rather than port count, managed if anyone will ever look at it. Exceptions, in order of frequency: one device on a legacy switch; a switch whose budget is already committed; a temporary link during a fault hunt. If the run is longer than 100 m, neither device helps and the answer is a PoE extender or fibre with a media converter at the far end — an injector in the middle of a long run just adds a connection point and a voltage drop.
Where I have changed my mind is the middle ground. For years I treated injectors as the cheap option and switches as the professional one, which was lazy. A badly specified switch with no per-port telemetry is worse than a good injector, and I have seen more networks broken by a 120 W switch full of 25.5 W devices than by midspans. The category is not the variable. Whether somebody actually did the power arithmetic is the variable. If you are picking a switch rather than an injector, the same numbers apply to the port count and the supply — the PoE switch range is the place to check what a given chassis can really allocate.
Questions I get on site
Can I run an injector into a PoE switch port?
No. Two PSEs on one link is a fault condition: you get either a port that refuses to come up or two supplies arguing over the same copper. Put the injector on a non-PoE port, or disable PoE on the port it feeds. I watched a midspan fight a switch port for an afternoon once, and all it produced was log noise.
Does an injector shorten the 100 m limit?
The channel limit is unchanged, but the injector does not give you extra distance for free. It adds two RJ45 interfaces and a short patch cord inside the 100 m budget, and every mated pair adds insertion loss and a reflection. Treat it as taking a metre or two off your usable length and plan the run at 90 m, not 99 m.
Why does my 90 W injector only deliver 30 W?
Almost always pair count. Class 5 through Class 8 require all four pairs energised. A 2-pair midspan negotiates at Class 4 and stops at 25.5 W at the PD. Check the label for a four-pair claim, then check the PD's reported class on the port — if it reads Class 4 on a Class 6 device, you have found it.
Can I power-cycle a camera through an injector remotely?
Only if the unit has a management interface and a relay, which is uncommon at the single-port end of the market. Managed midspans exist and cost more than a small PoE switch, which is usually the moment the conversation ends. If remote reset matters, buy the switch.
Is a 24 V passive injector safe with an 802.3af device?
No, and the reverse is worse. A 24 V passive supply presents no signature, so the af port will not power it, and a 48–57 V passive injector pushed into 24 V gear will cook the input stage. Match the standard on both ends, or use a splitter rated for the voltage you actually feed it.
Do I still need the injector if the switch has spare PoE budget?
No — that is the whole decision. Spare budget, a spare port, someone who can reach the switch: skip the outlet and the extra lead.
If you have a case where an injector did something its datasheet never promised, I want the details: the pair count, the class the PD actually asked for, and the ambient temperature where the unit was mounted. Those three numbers explain most of the surprises I have collected, and I am still collecting them.