A 4 kV or 6 kV figure on a PoE switch datasheet is a surge immunity test level, not a promise about your site. It means the port survived a defined 1.2/50 µs – 8/20 µs combination wave, applied between the port and earth, under lab conditions. It says nothing about what happens when lightning hits a camera pole 80 m away, because that event is shaped by your earthing, your cable route and your surge protective devices, not by the number in the brochure.
Last autumn I walked a car park outside Shenzhen with a maintenance contractor who had replaced the same four cameras three times in two years. The switches were 6 kV-rated units, well reviewed, not cheap. The earth pit at the gatehouse read 38 Ω. Nobody had measured it before, because the datasheet said 6 kV and everyone assumed that settled the question. Two of those ports had carbonised magnetics and a third had a TVS package blown clean off the board. The switch had done exactly what it was designed to do: absorb energy it should never have seen, because there was nowhere else for that energy to go.
That is the whole argument of this article. Buy the stack, not the number. I spend most of my working weeks on a test bench in Shenzhen putting these ports through surge rigs, and the gap between what a port survives on the bench and what it survives in a cabinet is almost always an installation question.
What the 4 kV line is actually measuring
IEC 61000-4-5 defines a combination wave generator: 1.2/50 µs open-circuit voltage, 8/20 µs short-circuit current. The standard's preferred test levels are 0.5, 1, 2 and 4 kV, with higher values permitted as special levels by agreement between buyer and vendor.
So when a manufacturer prints 4 kV, the honest reading is that the port passed the top of the generic immunity table. That is a real result. Most commercial PoE switches are only characterised at 1 kV differential and 2 kV common mode, and a fair number of cheap units are never surge-tested at all — they are designed to a schematic someone copied.
Three ambiguities hide inside the number, and I ask about all three before letting a 4 kV line into a specification.
Common mode or differential mode. Datasheets almost always mean common mode, port to earth. Differential mode, pair to pair, is typically tested at half the level, so "4 kV" often means 4 kV CM / 2 kV DM. If the sheet does not say which, assume common mode.
Which ports. A chassis figure is not a figure for the RJ45 magnetics. On a 24-port unit, the surge path that matters runs through each port's isolation transformer and its TVS network, not through the sheet metal.
Tested, or designed to. "Designed to meet" and "tested to meet" are different sentences, and only one of them comes with a report. Ask for the report. If a vendor cannot produce one, treat the number as a design intention.
One more thing worth knowing, because it trips up tender documents: 6 kV is not an IEC 61000-4-5 generic level. When you see it quoted, it is either a vendor-defined level or it comes from a telecom surge family such as ITU-T K.20/K.21, which assumes a different waveform and a different coupling model. It is not automatically "better than 4 kV". It is a different test. Compare reports, not numbers.
Why the outdoor port dies before the switch does
Every failure I get called in to look at happens in the same place: the port feeding the thing on the pole. Not the core switch, not the fibre uplink. The port.
The reason is geometry. An Ethernet cable running 80 m to a pole-mounted camera is not just a data cable. It is an antenna with two ends, and one end is bonded to a semiconductor junction specified for 1.5 kV rms of isolation, not for a nearby strike.
Three coupling paths matter, and two of them have nothing to do with the switch:
- Conductive. Strike current enters through the pole, the bracket or the camera housing, and travels down the cable.
- Inductive. A nearby strike induces a fast transient on the pair. This is the classic "camera dead, switch alive" pattern, because the pulse couples onto the pair and takes out the far-end PHY.
- Ground potential rise. The earth at the pole and the earth at the building sit at different potentials during a strike. That difference appears directly across your cable, and your port sees all of it.
In the car park case above, I spent two weeks blaming the cameras. The cameras were the cheapest part of the system and the easiest thing to blame, and the supplier replaced them without argument, twice. The actual fault was a floating mast earth and a shield bonded at both ends. Fixing that cost less than one camera.
Protection is three layers, and the switch is the third
Deployments that survive are designed at three levels. The port is the last of them, not the only one.
Layer one, at the cable entry. Every cable that leaves the building passes through a surge protective device at the point of entry: Type 1 (10/350 µs) where there is a direct-strike risk, Type 2 (8/20 µs) for induced surges on internal runs. This device takes the bulk of the energy and dumps it to earth. It is the highest-value item in the design and the one most often missing, because it does not appear in the switch's bill of materials. If you are running long outdoor spans, the extender and long-run options are worth reading alongside the SPD selection — distance and exposure rise together.
Layer two, at the port. This is what the 4 kV line describes. A port built properly uses a gas discharge tube for the coarse common-mode event and a fast TVS array for the residual. The GDT handles kiloamps but responds slowly; the TVS responds in nanoseconds but absorbs far less energy. Together they cover the waveform. Alone, each fails in a characteristic way: GDT-only ports let fast edges through, TVS-only ports erode after repeated small events and then fail short, taking the link down with them.
Layer three, the magnetics. 802.3 specifies 1.5 kV rms isolation between the PMD and the chassis. That is a safety barrier rather than a surge barrier, but it is the reason a well-designed port can survive an event that destroys the device at the far end.
All three layers depend on the same thing: a path to earth with low impedance.
The number that decides the outcome is earth resistance
I have watched a 6 kV-rated switch fail in the first storm of the season while a 2 kV-rated unit ran six years on an adjacent site. The difference was never the switch.
| Check | Target | Why it decides the outcome |
|---|---|---|
| Earth resistance at the service entrance | ≤ 4–5 Ω, ideally ≤ 1 Ω | Sets how much surge current actually leaves the equipment instead of crossing it |
| Bonding between pole earth and building earth | One bonded reference | Stops ground potential rise appearing across the cable pair |
| Shield or drain wire termination | One end only, at the building | Bonding both ends creates a loop and a return path for surge current |
| SPD lead length to the protected port | Short and straight | Every extra metre adds inductive drop, which is voltage your port still has to swallow |
| Port-to-chassis bond | Measured, not assumed | A floating chassis leaves port-level protection with nowhere to dump common-mode energy |
The last row is the one people skip. If the chassis is not bonded to the same reference as the SPD, the TVS network cannot do its job and the energy arcs across the magnetics instead. A 4 kV rating assumes a reference. If you do not provide one, you are running an unrated port with a nice sticker on it.
The lead-length row has a number behind it, and it is bigger than most people expect. A conductor has roughly 1 µH per metre. At a surge edge of 1 kA/µs, the voltage across that inductance is L × di/dt, which works out to about 1 kV per metre of lead. Half a metre of tidy cable routing is worth 500 V of clamping headroom. Coiling the spare lead neatly into a loop, which I see on maybe one in three sites, adds inductance and turns the SPD into a decoration.
Where 2 kV, 4 kV and 6 kV actually belong
Not every site needs the top of the range, and paying for it in the wrong place is how budgets get wasted.
| Rating | Where it belongs | Typical deployment |
|---|---|---|
| 1–2 kV | Indoor, short runs, no cabling leaving the building | Desk phones, indoor access points, office PoE |
| 4 kV | Cable leaves the building, or runs to an outdoor pole | Car park cameras, perimeter APs, signage, yard coverage |
| 6 kV vendor level | High exposure and a documented earthing design | Coastal and elevated sites, long outdoor spans, rail-side and yard towers |
A 4 kV industrial switch behind a correctly installed Type 2 SPD will beat a 6 kV unit installed without one, every time. Spend the difference on earthing and SPDs first; it buys more uptime per dollar than the port rating does.
Two product details matter as much as the headline number. First, surge components derate with temperature, so a port characterised at 4 kV at 25 °C inside a sealed cabinet at 60 °C is not a 4 kV port any more — ask for the derating curve rather than the single figure. Second, on industrial sites the more common failure is not lightning at all. It is a brownout or a dying power supply during a storm, which is why redundant DC input with a wide voltage range is worth more than one extra kV on the port.
What I check before signing off a design
- Does any cable leave the building? If yes, there is a Type 1 or Type 2 SPD at the entry, with a measured earth resistance written down.
- Is the pole earth bonded to the building earth, or floating? Floating means the design is not finished.
- What is the port-level rating in common mode, and is there a test report, not a design claim?
- Is the switch chassis bonded to the same reference as the SPD?
- What is the cabinet temperature at two in the afternoon in August, and what does the derating curve say at that temperature?
- Is there redundant DC input, and does it ride through a 20 ms dropout?
- If the run exceeds 100 m, is there a documented reason not to use fibre instead? A media converter pair removes the conductive path entirely, which is the cheapest surge protection available and also solves the distance limit.
Seven questions. Sites that can answer all seven stop calling me about dead cameras, and I have stopped being surprised by that.
Questions I get asked every week
Can I buy a higher kV switch and skip the SPD?
No. Port protection is the third layer, sized for residual energy. Without the first layer you are asking a TVS array to absorb an event it was never dimensioned for, and it will fail short rather than open.
Is 4 kV enough for outdoor cameras?
For inland, building-attached, well-earthed installations, yes. For pole-mounted runs past 100 m, elevated sites, or anything coastal, treat 4 kV as a minimum and put the money into earthing and SPDs. If you cannot measure the earth, you cannot answer this question for any rating.
Does shielded cable solve surge on its own?
No, and unbonded shielded cable makes it worse. Shielding controls induced coupling. It does not remove conducted energy, and a shield bonded at both ends gives that energy a return path.
Why did the camera die when the switch survived?
Because the switch's magnetics gave it 1.5 kV of isolation and the camera's did not, or because the two sat at different earth references. It is evidence of a grounding problem, not proof of a good switch.
Do PoE extenders help with surge?
They help with distance and they do not add protection. A passive extender in the middle of a long run adds another vulnerable point, which is why I would rather see fibre on those spans. If a camera has already died, the power-up troubleshooting checklist is the faster path than swapping hardware.
What does a surge failure actually look like?
Usually nothing dramatic. A port that negotiates class, powers the device, then drops the link under load. Sometimes one dead port on an otherwise healthy switch. Occasionally a scorch mark under a TVS. The switch passes its own self-test the whole time, which is why these get logged as "camera fault" for weeks.
If you are specifying for an outdoor or industrial site, the sentence worth pasting into your RFQ is this: port-level surge immunity of at least 4 kV common mode per IEC 61000-4-5, evidenced by a test report, with a Type 2 SPD at the cable entry, a documented earth resistance, and single-point bonding of every shield. I have watched that one sentence end more arguments than any datasheet. The PoE switch range and the industrial models are where I usually start when a site actually needs the higher rating, but the earthing comes first either way.