Power over Ethernet (PoE): Standards, Protocols & Power Types

A Guide to Power Over Ethernet (PoE):
Standards, Protocols & Power Types

Power over Ethernet (PoE) is one of the most quietly transformative technologies in modern networking. It lets you deliver both data and DC power over a single Ethernet cable, eliminating the need for dedicated electrical outlets at every access point, camera, phone, and sensor in your environment. What started as a modest 15-watt convenience in 2003 has grown into a family of standards capable of pushing nearly 100 watts per port; enough to power laptops, LED lighting panels, and multi-radio Wi-Fi 7 access points.

But here's the thing: the terminology around PoE has gotten messy. Between IEEE standards, vendor-specific branding, passive PoE injectors, and marketing names like "UPoE" and "PoE++," it's easy to lose track of what actually matters when you're speccing out a deployment.

This guide breaks down every major PoE standard, protocol, and power type; what it delivers, how it works, and when you'd actually use it.

How PoE Works: The Basics

Before diving into the standards, it helps to understand the core components and mechanics.

A PoE system has three parts: a Power Sourcing Equipment (PSE) (typically a PoE-capable switch or a midspan injector) that supplies power; a Powered Device (PD); the endpoint consuming power (camera, AP, phone, etc.); and the Ethernet cable connecting them.

The PSE delivers 48V DC over the Ethernet cable's twisted copper pairs. The PD receives that voltage and converts it down to whatever it needs internally. The maximum cable run for all PoE standards is 100 meters (328 feet), dictated by Ethernet's own physical limitations, not PoE itself.

Active vs. Passive PoE

This is the most critical distinction in the PoE world, and getting it wrong can fry equipment.

Active PoE (IEEE-compliant): This uses a detection and classification handshake before delivering power. The PSE sends a small test voltage (2V–10V) to see if a compatible PD is connected. If the device responds with the correct 25kΩ resistance signature, the PSE knows it's safe to apply full power. No handshake, no power. This is the core safety mechanism in all IEEE 802.3 PoE standards.

Passive PoE: This skips the handshake entirely. The port is always energized as power is applied continuously whether or not a compatible device is plugged in. Passive PoE is cheap and simple, but it carries real risk: plug in a device that isn't designed for it and you can damage or destroy it. There's no negotiation, no classification, and no safety net. Passive PoE is common in budget networking gear, particularly some older Ubiquiti and MikroTik products, and in DIY/maker applications.

Bottom line: Always prefer IEEE-compliant Active PoE for production deployments. Passive PoE has its uses (embedded projects, matched hardware sets), but never mix passive PSEs with unknown PDs.

The IEEE Standards: The Official PoE Family

IEEE 802.3af - PoE (Type 1)

• Ratified: 2003
• Marketing name: PoE
• Max PSE output: 15.4W
• Max power at PD: 12.95W
• Pairs used for power: 2 (Mode A or Mode B)
• Minimum cable: Cat 3
• Supported data rates: 10/100/1000 Mbps

This is where it all started. 802.3af introduced standardized PoE with enough power for the devices that were driving adoption at the time: VoIP phones, basic wireless access points, and simple IP cameras. The roughly 3-watt gap between PSE output and PD available power accounts for resistive cable losses over a 100-meter run.

Power can be delivered via Mode A (also called Alternative A), where DC is overlaid on the data pairs (pins 1/2 and 3/6), or Mode B (Alternative B), which uses the spare pairs (pins 4/5 and 7/8). The PSE only needs to support one mode, but the PD must accept power from either.

Typical devices: VoIP phones, basic access points, simple IP cameras, small sensors.

IEEE 802.3at - PoE+ (Type 2)

• Ratified: 2009
• Marketing name: PoE+
• Max PSE output: 30W
• Max power at PD: 25.5W
• Pairs used for power: 2 (Mode A or Mode B)
• Minimum cable: Cat 5
• Supported data rates: 10/100/1000 Mbps

PoE+ doubled the available wattage by allowing higher current on the same two-pair delivery model. This opened the door for PTZ (pan-tilt-zoom) security cameras, more capable wireless access points, small displays, and biometric door readers.

802.3at introduced Layer 2 power negotiation using LLDP (Link Layer Discovery Protocol), allowing the PD and PSE to communicate more precisely about power requirements beyond the basic physical-layer classification. This makes power allocation more efficient across large switch deployments.

PoE+ is fully backward compatible with 802.3af; a PoE+ switch will safely detect and power an older PoE device at the appropriate wattage.

Typical devices: PTZ cameras, 802.11ac/Wi-Fi 5 access points, video intercoms, some thin clients.

IEEE 802.3bt - PoE++ (Type 3 and Type 4)

The big leap. Ratified in 2018, 802.3bt introduced two new types and fundamentally changed what PoE can power by utilizing all four twisted pairs in the cable for power delivery (called 4PPoE or 4-Pair Power over Ethernet).

Type 3 (PoE++ / 4PPoE)

• Marketing name: PoE++, 4PPoE
• Max PSE output: 60W
• Max power at PD: 51W
• Pairs used for power: 4
• Minimum cable: Cat 5
• Supported data rates: 10/100/1000/2.5G/5G/10G Mbps

Type 4 (PoE++ / UPoE+)

• Marketing name: PoE++, UPoE+, 4PPoE
• Max PSE output: 90–100W
• Max power at PD: 71–90W
• Pairs used for power: 4
• Minimum cable: Cat 5e (Cat 6 recommended)
• Supported data rates: 10/100/1000/2.5G/5G/10G Mbps

802.3bt standardized eight power classes (Classes 1–8), replacing the more limited classification system from earlier standards. Classes 1–4 map to the older af/at devices, while Classes 5–8 were added for the higher power levels:

• Class 5: Up to 40W at PD
• Class 6: Up to 51W at PD
• Class 7: Up to 62W at PD (Type 4 only)
• Class 8: Up to 71W at PD (Type 4 only)

802.3bt also added Autoclass, a mechanism where the PSE measures the PD's actual power draw over time and allocates accordingly, rather than reserving the full class maximum. This is a major improvement for power budgeting in high-density switch deployments.

Cable quality matters more at these power levels. Running 60–90 watts through bundled cables generates meaningful heat, and Cat 6 or better cabling is strongly recommended for Type 3 and Type 4 deployments. Follow TIA/IEEE installation guidelines for cable bundling and thermal management.

Typical devices: Wi-Fi 6/6E/7 multi-radio access points, LED lighting systems, building automation controllers, PTZ cameras with heaters/wipers, digital signage, compact laptops, small point-of-sale terminals.

Power Class Reference Table

Class	Type	Max PSE Output	Max Power at PD	Typical Use
0	1	15.4W	12.95W	Default / classification unknown
1	1	4.0W	3.84W	Basic sensors, some IoT
2	1	7.0W	6.49W	IP phones, simple cameras
3	1	15.4W	12.95W	Single-radio APs, fixed cameras
4	2	30.0W	25.5W	PTZ cameras, dual-radio APs
5	3	45.0W	40.0W	Multichannel video, advanced APs
6	3	60.0W	51.0W	Wi-Fi 6E APs, PoE lighting
7	4	75.0W	62.0W	Building automation controllers
8	4	90–100W	71–90W	Laptops, high-power displays

Mode A vs. Mode B vs. 4-Pair: Power Delivery Methods

Understanding how power physically travels through the cable is important for troubleshooting and compatibility.

Mode A (Alternative A): This mode delivers power over the data pairs: pins 1/2 and 3/6. The DC power is overlaid on the same pairs carrying Ethernet data, which works because the data signal is AC and the power is DC; they don't interfere with each other. In 10/100 Mbps Ethernet, this means power rides on the active data pairs. In Gigabit Ethernet (which uses all four pairs for data), Mode A still technically uses the same physical pairs.

Mode B (Alternative B): This mode delivers power over the spare pairs: pins 4/5 and 7/8. In 10/100 Mbps Ethernet, these pairs aren't used for data, making them entirely available for power. This is the method most commonly used by midspan injectors, since they can add power to the spare pairs without touching the data signal.

4-Pair (4PPoE): This mode uses all four twisted pairs simultaneously, doubling the current-carrying capacity. This is mandatory for 802.3bt Type 3 and Type 4. Both Mode A and Mode B pairs carry power at the same time.

For 802.3af and 802.3at, PSEs must support at least one mode. PDs must support both. For 802.3bt, 4-pair power delivery is required on both sides.

Proprietary and Vendor-Specific PoE Standards

Not everything lives within the IEEE umbrella. Several vendors developed their own PoE extensions to push beyond what the standards offered at the time.

Cisco UPoE (Universal PoE)

Cisco's original UPoE predated the 802.3bt standard and was a proprietary solution delivering up to 60W per port using all four pairs. It was designed for Cisco's own ecosystem of high-power access points, video conferencing endpoints, and compact desktop switches. Modern Cisco switches marketed as UPoE+ are fully compliant with IEEE 802.3bt Type 4 and are interoperable with any standards-based PD.

LTPoE++ (Linear Technology / Analog Devices)

LTPoE++ is a proprietary specification developed by Linear Technology (now part of Analog Devices) that extended PoE to 90W of PD-delivered power before 802.3bt was ratified. It uses a mutual identification protocol between PSE and PD; the PSE can distinguish an LTPoE++ device from a standard IEEE PD, maintaining backward compatibility. LTPoE++ was designed for power-hungry applications like picocells, outdoor base stations, and heated PTZ cameras.

Passive PoE (Various Vendors)

As discussed earlier, passive PoE is a catch-all term for any non-standard PoE implementation that applies power without the IEEE detection handshake. Common variants include 24V passive (popular on older Ubiquiti and MikroTik gear) and 48V passive. Some passive implementations use Mode B only (spare pairs), while others use Mode A or all four pairs. The critical point: passive PoE devices should only be paired with matched, known-compatible hardware.

Negotiation Protocols: LLDP and CDP

Beyond the physical-layer resistance-based classification that happens during initial detection, modern PoE systems use Layer 2 protocols for more granular power negotiation.

LLDP-MED (Link Layer Discovery Protocol — Media Endpoint Discovery) is the IEEE-standard protocol used for PoE power negotiation in 802.3at and 802.3bt deployments. It allows the PD to advertise its exact power requirements to the PSE, and the PSE to communicate what it can deliver. This enables more efficient power allocation; instead of reserving the maximum class wattage, the PSE can allocate only what the PD actually needs.

CDP (Cisco Discovery Protocol) is Cisco's proprietary Layer 2 protocol that performs similar power negotiation on Cisco equipment. In mixed-vendor environments, LLDP is the universal choice. Most modern Cisco gear supports both.

What Standard Should You Deploy?

The answer depends on what you're powering, but here's a practical decision framework.

Go with 802.3at (PoE+) switches if your environment is primarily VoIP phones, basic IP cameras, single-radio access points, and simple IoT sensors. PoE+ covers the vast majority of standard enterprise endpoints, and PoE+ switches are the cost-effective workhorse for most deployments.

Upgrade to 802.3bt (PoE++) if you're deploying Wi-Fi 6E or Wi-Fi 7 access points (which frequently draw 30–50W+), high-end PTZ cameras with heaters, LED lighting, building automation systems, or if you want to future-proof for emerging high-power IoT devices. The trend is clear; Wi-Fi 7 APs are pushing the infrastructure toward 60W per port as a baseline.

Avoid passive PoE for production networks. Reserve it for controlled lab environments, matched hardware sets, or embedded projects where you fully control both ends of the cable.

Regardless of the standard, remember that your total PoE power budget at the switch matters as much as per-port capability. A 24-port PoE++ switch can technically deliver 90W per port, but that doesn't mean it has the internal power supply to do so on all 24 ports simultaneously. Always check the switch's total available PoE wattage and plan your per-port allocation accordingly.

PoE Testers and Troubleshooting Tools

Having the right test equipment is just as important as understanding the standards. PoE problems can be maddeningly vague; a camera that reboots intermittently, an AP that won't power up on a long run, a switch port that shows PoE enabled but the PD disagrees. Without the right tools, you're stuck swapping cables and guessing. Here's a breakdown of the categories of PoE testing tools and when each one earns its place in the bag.

Basic PoE Testers (Indicator / Detection Tools)

These are the simplest and cheapest tools in the category. You plug one end into a PSE port (switch or injector) and the tester tells you whether power is present, which pairs are carrying it, the voltage level, and sometimes the detected PoE standard (af/at/bt). Some display polarity and continuity as well.

They're useful for quick "is there power on this port?" checks during installation, but they don't simulate a PD or perform load testing, so they can't tell you whether the port will actually deliver its rated wattage under real conditions. Think of them as a PoE-specific multimeter; fast and simple, but limited.

Examples include the Noyafa NF-488 (~$30–$40) and various budget inline indicator dongles. Good for the truck, good for quick field checks, but don't rely on them for commissioning or troubleshooting intermittent issues.

Inline PoE Testers

Inline testers sit between the PSE and PD; you patch them in series so live traffic and power flow through the tester while it monitors. This gives you real-time readings of voltage, current, and wattage actually being delivered to the device in production, not just what the port is capable of in theory.

This is the tool category you want for troubleshooting intermittent power problems: a camera that randomly reboots, an AP that drops during peak load, or a PD that works on a short patch cable but fails on a 75-meter run. By watching actual power delivery over time, inline testers reveal voltage sag, marginal connections, and underpowered ports that look fine in a quick check.

The Triplett POE3000 is a solid example in this category; it detects PSE type/class, power source, polarity, voltage, and provides continuous inline monitoring. More advanced units also display link speed and duplex status.Cable Verifiers with PoE Detection

This is where PoE testing meets cable testing in a single handheld device, and it's arguably the most practical category for field technicians doing installation and day-to-day troubleshooting.

The Fluke Networks MicroScanner PoE is the standout here. It combines a graphical wiremap (showing opens, shorts, crossed pairs, and split pairs), cable length measurement, distance-to-fault via TDR, cable ID for identifying runs, network speed detection up to 10G, and PoE class detection for Classes 0–8. It also detects passive PoE voltage from non-standard sources and has built-in IntelliTone toning for tracing cables on active networks.

The MicroScanner PoE can negotiate and solicit PoE from active sources at the hardware or link layer using LLDP, and it supports standard IEEE 802.3af/at/bt as well as Cisco UPOE. It answers the two most common field questions simultaneously: "Is the cable good?" and "Is the port delivering power?"

The industrial Ethernet variant (MS-POE-IE) adds support for M12X, M12D, and M8D connectors found in factory automation and OT environments which is useful if your clients have industrial Ethernet installations alongside their IT networks.

PoE Load Testers / Network Qualifiers

This is the professional tier. So tools that don't just detect PoE but actively draw a real load on the port to verify that the advertised power is actually deliverable across the full cable run. This distinction matters because a switch port might report "60W available" via LLDP, but cable resistance, connector quality, patch panel losses, and bundle heating can mean the PD at the far end only sees 48W under load.

The Fluke Networks LinkIQ Cable + Network Tester is a key tool in this category. It receives LLDP and CDP discovery packets from the switch, identifies the port, VLAN, advertised speeds, and negotiated PoE class, then places an actual watt load on the connection. It shows which pairs are carrying power, the negotiated class (0–8), and the loaded power in watts being delivered at the PD end. It also performs cable speed qualification (verifying the cable can support 1G, 2.5G, 5G, or 10G speeds), TDR-based cable diagnostics, and wiremap testing; all without requiring a live network for the cable tests.

The NetAlly LinkRunner AT family goes further. The recently launched LinkRunner AT 1500 ($1,495 MSRP) provides an automated 8-step AutoTest that validates PoE delivery (up to 90W with their TruePower load testing), DHCP/DNS functionality, nearest switch identification via CDP/LLDP/EDP, link speed detection up to 10G, and cable diagnostics including length, wiremap, and fault location. The higher-end LinkRunner AT 3000 adds fiber optic testing and SFP diagnostics. Optional Wi-Fi and Bluetooth adapters enable remote operation.

The Trend Networks PoE Pro is another professional-grade option that identifies PoE equipment type, detects the running media service (Ethernet, ISDN, PBX, PoE), shows network speed and duplex, and stores results to a mobile app with cloud-backed PDF reporting.

These tools pay for themselves on the first complex troubleshooting call where the alternative is hours of cable swapping and escalation.

Network Analyzers with PoE Capabilities

At the top of the stack are full network analyzers that include PoE validation as one capability among many. The NetAlly EtherScope nXG and the Fluke Networks DSX-8000 CableAnalyzer sit here. These are enterprise-grade instruments that handle full ANSI/TIA cable certification, multi-gig qualification, PoE validation, Wi-Fi analysis, and network discovery in a single platform.

These are overkill for pure PoE troubleshooting but invaluable for MSPs, integrators, and IT departments that need to certify cabling installations, validate PoE performance, and troubleshoot network issues from a single device. If you're commissioning a new building's structured cabling with PoE++ throughout, these are the tools that give you the documentation to prove everything works.

Software-Based PoE Monitoring

Don't overlook what your managed switch already gives you. Most enterprise switches from Cisco, Aruba, Juniper, and UniFi provide per-port PoE statistics via their management interfaces, SNMP, or CLI; including allocated vs. drawn wattage, PoE events and errors, power budget utilization, and port-level power cycling. SNMP-based monitoring through tools like Netdata, LibreNMS, PRTG, or Zabbix can trend PoE power draw over time and alert on anomalies.

This is your first line of defense for ongoing monitoring. Physical testers are for installation, commissioning, and hands-on troubleshooting; software monitoring is for catching the problems that develop over time. Such as a slowly degrading connector, a PD drawing more power as it ages, or a switch approaching its total PoE budget limit.

Common PoE Troubleshooting Scenarios

Here are a few real-world scenarios where the right tool makes all the difference.

• PD won't power up at all.
  Start with a basic PoE tester or cable verifier to confirm the port is delivering power and identify the detected class. If power is present but the PD won't negotiate, check for a passive/active mismatch; the PSE might be passive while the PD expects IEEE handshake, or vice versa. Verify cable continuity and wiremap; a single broken conductor on a power pair kills the whole thing.
  
  
• PD powers up but reboots intermittently.
  This screams voltage sag or marginal power delivery. Use an inline tester to monitor voltage and wattage in real time under load. Common culprits: cable runs near or at 100 meters, poor patch cable quality, dirty or damaged connectors, or a switch port that's technically PoE+ but is being power-budgeted down because the switch's total PoE supply is oversubscribed.
  
  
• PoE works on a short cable but not on the installed run.
  Use a cable verifier to check length and TDR for opens/shorts. Then use a load tester to verify actual delivered wattage at the far end. Resistance increases with length, and marginal cables that pass a wiremap test can still fail to deliver enough power at distance. Cat 5e cable running 90 watts at 90 meters is operating at the ragged edge; cable quality, ambient temperature, and bundle size all matter.
  
  
• Switch shows PoE enabled but PD says no power.
  Check the switch's total PoE budget; you may have allocated more power across ports than the switch's internal power supply can deliver. Many switches silently refuse to power new PDs when the budget is exhausted rather than throwing an obvious error. Also verify that the port isn't administratively disabled for PoE, and check for LLDP/CDP negotiation mismatches between vendor ecosystems.

Looking Ahead

PoE continues to evolve alongside the devices it powers. Wi-Fi 7 deployments are already driving demand for 60W+ per port across enterprise environments. LED lighting over PoE is gaining traction in smart building designs. And as more edge compute, digital signage, and automation endpoints move to single-cable power, PoE infrastructure planning is becoming just as critical as the data network itself.

The good news: backward compatibility is baked into every IEEE standard. A modern 802.3bt switch will safely negotiate down to power a decade-old 802.3af VoIP phone. Investing in the latest standard today doesn't strand your existing devices; it just gives you headroom for what's coming next.

Created & Maintained by Pacific Northwest Computers

Pacific NW Computers

www.linktr.ee/pnwcomputers

www.pacificnwcomputers.com

📞 Pacific Northwest Computers offers Remote & Onsite Support Across: 

SW Washington including Vancouver WA, Battle Ground WA, Camas WA, Washougal WA, Longview WA, Kelso WA, and Portland OR