PoE, switches and cabling for guest WiFi: a no-jargon guide

An electrician once asked me where the plug socket was for the access point on the ceiling. There wasn't one. There was never going to be one. The whole point of the kit we were fitting was that it would draw its power down the same cable that carried its data, from a switch in the cupboard forty metres away. He thought I was winding him up.

This is the part of venue WiFi that quietly trips up every owner who has ever rung round for quotes. You keep hearing "PoE" and "Cat6" and "power budget", everyone says them like you should already know, and nobody slows down to explain. So you nod along and hope the installer knows what they are doing. Sometimes they do. Sometimes you end up with an access point that boots, sulks, drops half its radios and resets itself every twenty minutes because it is being starved of power, and nobody can work out why.

Here is the good news: there are about five things to understand, the maths is simple, and once you have them you can brief a cabling job or wire it yourself without getting bluffed. CaptiFi does not do cabling, we are the captive portal that sits on top of your network, but we spend a lot of time talking venues through their kit, and this is the conversation we have most.

What Power over Ethernet actually is

Power over Ethernet, almost always shortened to PoE, means one cable does two jobs. It carries your data, the same as any network cable, and it also carries low-voltage electricity to run the device on the other end. One run of Ethernet, no separate power supply, no plug socket needed at the access point.

That is the magic. An access point belongs on a ceiling or high on a wall, which is exactly where you do not want to be fitting a mains socket and a chunky power brick. With PoE, the power comes from a switch (or a small injector) back in your comms cupboard, travels along the data cable, and arrives at the AP. The device you are powering is called the PD, the "powered device". The thing supplying the power, your switch or injector, is the PSE, the "power sourcing equipment". Those two acronyms turn up on every datasheet, so worth knowing.

The reason power numbers come in pairs (one for the switch, a lower one for the device) is that some electricity is lost as heat along the copper. The switch might push out 30 watts; by the time it reaches the access point, you are guaranteed something less. That gap matters when you are matching a switch to a hungry AP, which we will get to.

The PoE standards, in one table

PoE is not one thing. It has grown over twenty years through a series of IEEE standards, each delivering more power for thirstier devices. The names are a mess of letters and marketing, so here is the honest version. The figures below are straight from the IEEE 802.3 standards (via the Wikipedia "Power over Ethernet" reference table, corroborated by Phihong and FS.com).

A few things worth knowing. The newer standards are backward compatible, so an 802.3at switch will happily run an old 802.3af device. The Type 3 and Type 4 tiers (the 2018 802.3bt standard) use all four pairs of wires in the cable for power, where the older ones used two. And ignore anyone quoting "100 watts" for Type 4: that is a vendor marketing figure. The actual IEEE maximum at the switch port is 90 watts, with 71.3 watts guaranteed at the device.

The number that matters is the guaranteed-at-device figure, not the headline switch number. An access point that needs 25 watts is not safe on a 30 watt switch port if that port only guarantees delivery of a lower wattage down a long cable run.

Matching wattage to your access point

This is where the standards table earns its keep. Every access point has a PoE input requirement on its datasheet, and your job is to feed it a standard that comfortably exceeds that figure. Under-power an AP and it rarely refuses to start outright; that is the degraded state from the intro, and it looks exactly like a coverage problem, so it gets misdiagnosed for weeks.

The rough hierarchy: a small or mid-range access point with two radios (the kind that suits a cafe or a single-room shop) typically runs happily on plain PoE or PoE+, so 802.3af or 802.3at. A current flagship with three radios, wider channels and Wi-Fi 7 features tends to want more, which is where 802.3at or the 802.3bt tiers come in. The newest top-end APs with multiple high-power radios are the ones that push you towards Type 3 or Type 4.

So if you are weighing up, say, a mid-tier UniFi access point against a flagship like the E7, the cabling question is not academic: the bigger AP can need a beefier PoE standard, and that changes the switch you buy. Always read the datasheet for the exact model and the exact firmware, because requirements creep up as features are added. We go deeper on picking the right unit in our guide to choosing an access point for guest WiFi, and on the specific trade-offs of Ubiquiti's flagship in our piece on the UniFi E7 Wi-Fi 7 access points.

The 100 metre rule nobody warns you about

Ethernet over copper has a hard distance limit, and it is one of the most useful facts you will ever learn about cabling. The standardised maximum is 100 metres (328 feet) for Cat5e, Cat6 and Cat6a, set by the TIA/EIA structured-cabling standards.

There is detail in that 100 metres, and it catches people out. The standard splits it into 90 metres of fixed cable (the run buried in walls and ceilings, the "permanent link") plus 10 metres of patch leads (the flexible cables that connect your switch to the wall socket, and the wall socket to the device). So if you are planning a run, your in-wall cable should not exceed 90 metres, leaving room for the patch cords at each end.

Why does it matter to a pub or a salon? Because if your broadband comes into a back office and the access point needs to go above the bar at the far end of a long building, you need to know whether that run is inside 100 metres before anyone quotes you. Most single venues are nowhere near the limit. But long thin buildings, a unit with a yard, or anywhere you are daisy-chaining through a couple of cupboards, can creep up on it. Go past 100 metres and the link does not just get slower; it becomes unreliable in ways that are miserable to diagnose. If you genuinely cannot make the distance, that is when you look at a second switch nearer the AP, fibre, or as a last resort a wireless link. We cover why wireless backhaul is a compromise in mesh vs wired access points for venues.

Cat5e vs Cat6 vs Cat6a: what you really need

Here is the section that saves you money. The cable category debate gets oversold, and for most venue WiFi you need far less than the bloke in the wholesaler will try to upsell you.

The headline most people miss: Cat5e is not the obsolete cable it is made out to be. IEEE 802.3bz-2016 confirmed that 2.5GBASE-T and 5GBASE-T run over Cat5e or better at the full 100 metres. That means Cat5e comfortably carries 2.5 gigabit Ethernet across a normal venue, and 2.5 gigabit is more uplink than the overwhelming majority of access points will ever use. If your existing building is already wired with decent Cat5e, you very probably do not need to rip it out.

Cat6 supports gigabit at the full distance and 5 gigabit at 100 metres, but its 10 gigabit rating drops to just 55 metres because of crosstalk between adjacent cables. Cat6a fixes that, carrying 10 gigabit across the whole 100 metres. Both are worth it if you are running a brand-new install and want a backbone that lasts a decade, or if you are wiring a 10 gigabit link between switches. For the cable that simply feeds one access point, Cat6 is a sensible, cheap default and Cat5e is genuinely fine.

PoE switch or PoE injector?

Two ways to get power onto your Ethernet, and the choice is mostly about how many devices you are feeding.

A PoE switch is a network switch with the power built into its ports. It does both jobs at once: it connects all your devices to the network and powers the PoE ones, several at a time, with no extra hardware. If you have more than one or two access points, or you expect to grow, a PoE switch is the right answer. It is tidier, it gives you one place to manage everything, and it scales.

A PoE injector is a small in-line box (a "midspan") that adds power onto a single Ethernet run. You plug your ordinary, non-PoE network into one side, the access point into the other, and the injector slips the power in between. It powers one device at a time. Injectors are the right call when you have exactly one AP, your existing switch or router has no PoE, and buying a whole PoE switch would be overkill. They are also handy as a get-out-of-jail fix when you discover on the day that your switch cannot power that one stubborn unit.

One AP and a non-PoE router: get an injector. Two or more APs, or any plan to expand: get a PoE switch and stop thinking about it.

How to read a switch power budget

This is the single most useful skill in the whole guide, and it is where DIY installs go wrong. A PoE switch does not just have a per-port power rating. It has a total power budget: the combined wattage it can supply across all its PoE ports at once. That total is shared, not guaranteed per port.

An example to make it real (and this is illustrative, not a fixed standard, because budgets vary by model). Say you have an eight-port PoE switch with a roughly 120 watt total budget. No single port is overloaded if you plug in a 30 watt access point. But plug in five 30 watt access points and you are asking for 150 watts from a switch that can only give 120. The switch starts refusing power to ports, usually the lowest-priority ones, and that is when the AP at the back mysteriously stops working.

So when you read a switch datasheet, find two numbers: the per-port maximum (which standard each port supports) and the total PoE power budget. Then add up the guaranteed-at-device draw of everything you intend to plug in. If your total demand is anywhere near the budget, size up. The maths:

1. List every PoE device and its rated power draw.
2. Add them together for your worst-case simultaneous load.
3. Compare against the switch's total PoE budget, not the per-port figure.
4. Leave at least 20 to 30 percent headroom for growth and for power lost in the cable.

Get this right and you avoid the two classic mystery faults: a cable run that has crept over 100 metres, or a power budget that has been quietly exceeded. Nine times out of ten, a flaky access point is one of those two and nothing to do with the wireless at all.

How to brief an installer (or DIY it)

You now know enough to have a proper conversation. If you are hiring someone, ask them four questions and listen to whether the answers are confident or waffly.

• What PoE standard does each access point need, and what does the switch deliver? They should name the standard (af, at or bt) for each, not just say "it'll be fine".
• How long is the longest cable run, and is it inside 90 metres of fixed cable? A good installer will already have measured or paced it.
• What is the total PoE budget of the switch, and what is our total draw? If they cannot tell you the budget, they have not chosen the switch properly.
• Are we Cat5e, Cat6 or Cat6a, and why? Any of the three can be the right answer; the point is that they have a reason.

If you are doing it yourself for a small venue, the simple recipe is: one managed PoE+ switch with a comfortable budget, Cat6 cable on new runs (or keep good Cat5e if it is already in), keep every run under 90 metres, and buy a switch that supports a tier above what your APs need today. That covers a cafe, a salon or a small shop without drama. For specific controller and portal wiring once the cabling is in, our UniFi setup guide and Omada setup guide walk through the software side.

Where CaptiFi fits in all this

Honestly: not in the cabling at all. CaptiFi does not sell, ship, install or wire hardware, and we are not electricians or a cabling firm. What we do is sit on top of the network you have just wired. Once your access points are powered and your guests can connect, CaptiFi adds the branded captive portal, the email capture, and the Google review automation that turns free WiFi into a marketing channel.

We authorise guests through your controller's API (UniFi, TP-Link Omada, Cisco Meraki, Aruba, MikroTik, Ruckus, Cambium, DrayTek), so there is no RADIUS server to stand up and nothing extra to run alongside your switch and APs. If your controller does not expose a usable API, we work around it on the portal side rather than asking you to add kit. Many venues using CaptiFi capture a large share of their connecting guests as email subscribers, often 40 to 60 percent. Consent is GDPR and PECR compliant out of the box.

The reason we wrote this guide is selfish in the nicest way: the portal only shines on a network that actually works. An under-powered AP or a 110 metre cable run will undo the cleverest marketing. Get the boring cabling right first, and the rest is easy. You can see supported kit on our hardware page, and if you want to try the portal on your existing network there is a 30-day free trial with no card from $69/mo.

Sources: IEEE 802.3af/at/bt standards via the Wikipedia "Power over Ethernet" reference table (corroborated by Phihong and FS.com); IEEE 802.3bz-2016 and the Wikipedia "2.5GBASE-T and 5GBASE-T" and "Category 6 cable" articles; TIA/EIA structured-cabling distance figures via comms-express.com and truecable.com; PoE switch, injector and power-budget definitions from omnitron-systems.com, versatek.com and cablewholesale.com. CaptiFi figures are our own observed averages across venues. Standards and prices were correct at the time of writing (June 2026); always check the datasheet for your exact access point and switch model before ordering.