IP CCTV on the network: the design basics that prevent headaches

Modern CCTV is a network project. Every IP camera is a small computer that sends a continuous video stream, draws power over the cable and runs firmware that needs updates. Treat it like a few desk phones and you will meet slow networks, dropped recordings and security problems. Plan it properly and it runs quietly for years.

1. Separate the cameras

Put cameras and the recorder (NVR or video management server) in their own VLAN. Allow only the traffic that is needed: cameras to recorder, and recorder or viewing clients to the people who need them. Cameras should not be able to reach the rest of the network or the internet directly. Our note on IoT network segmentation explains the principle.

2. Do the bandwidth sums

Each camera's bitrate depends on resolution, frame rate, codec and scene activity. A busy, high-resolution scene uses far more than a quiet corridor. Add up the expected bitrate of every camera on each switch and uplink, then add headroom. Use H.265 where the recorder supports it, and consider lower frame rates for areas that do not need smooth motion. Our bandwidth calculator helps with storage and link estimates.

3. Check the PoE budget

Most IP cameras are powered over Ethernet. Every PoE switch has a total power budget, and PTZ cameras, heaters and infrared illuminators can draw much more than a basic fixed camera. List each camera's maximum draw, compare it with the switch budget and leave a margin. Our PoE calculator helps, and our post on VoIP and PoE rollouts covers the same pitfalls.

4. Storage and retention

• Agree the retention period with management and, where relevant, privacy or legal advisers.
• Calculate storage from bitrate, hours of recording and days of retention, then add headroom.
• Use RAID or equivalent protection on the recorder and monitor disk health.
• Decide who may view and export footage, and log exports.

5. Harden every camera

1. Change default passwords before the camera ever reaches its final location.
2. Update firmware at installation and on a schedule afterwards.
3. Disable unused services such as Telnet, UPnP and cloud features you do not use.
4. Synchronise time with NTP so evidence timestamps are accurate.
5. Keep cameras and recorders off the internet. For remote viewing, use a VPN or the vendor's supported secure method, never port forwarding to the recorder.

6. Document as you go

Record each camera's location, IP address, switch port, MAC address, firmware version and field of view. A simple spreadsheet plus floor plan saves hours when a camera goes offline. See network documentation that actually gets used.

7. Privacy and signage

CCTV captures personal data. Follow local law and organisational policy on where cameras may point, signage, retention and access requests. Avoid areas where people expect privacy. Getting this right protects people and the organisation alike.