Skip to content

Engineering note

Three networks, one switch, no excuses

CCTV, IPTV and crew internet end up on the same hardware because there is only one rack and one cable route. Segregation is what stops a camera storm from taking the television down with it — and it is a design decision, not a switch setting applied afterwards.

What segregation is actually for

A flat network has two problems. The obvious one is security: every device can reach every other device, including the camera that the crew found the default password for. The less obvious one is traffic behaviour — a recorder pulling sixteen streams, or a multicast group flooding a switch without IGMP snooping, degrades everything else on the same broadcast domain.

VLANs solve both, but only if the boundaries follow function. The workable split on a vessel is three: surveillance (cameras and recorders), content distribution (IPTV headend and clients), and crew or operational data. Each gets its own subnet and its own multicast scope.

The VLAN plan

Write the plan before buying switches, because it decides how many ports need to be trunk-capable and where the routing happens. A flat three-VLAN design is enough for most vessels; a fleet that shares a monitoring platform adds a management VLAN so the office can reach equipment without touching the other three.

  • VLAN 10 — surveillance: cameras, NVR, camera-side PoE
  • VLAN 20 — content: IPTV headend, set-top clients, information pages
  • VLAN 30 — crew / operational data: access points, terminals, office link
  • VLAN 99 — management: switch management, ACU web interface, out-of-band access
  • Inter-VLAN routing only where a service needs it: the monitoring client reaching the NVR, not the crew laptop reaching the camera

PoE is a budget, not a feature

Each camera draws power from the switch, and the switch has a total budget that is smaller than the sum of its port ratings. A 24-port PoE switch rated 30 W per port often has a 240–400 W total budget — enough for a dozen cameras, not twenty-four.

Compute the load from the datasheet figures, add 20% for IR at night (IR LEDs are the peak draw, not the daytime figure), and leave headroom for the recorder if it is also PoE. Under-budgeting shows up as cameras that reboot at dusk, which is the hardest fault to diagnose because it looks like a camera problem.

Multicast and the IPTV layer

IPTV is a multicast service, and multicast without IGMP snooping floods every port in the VLAN. On a small vessel that is invisible; on a ferry with sixteen set-top boxes it saturates uplinks and the picture breaks up on channels nobody is watching.

Enable IGMP snooping on every switch in the content path, designate one querier, and keep the multicast scope inside VLAN 20. If the headend offers unicast for small deployments, use it: sixteen unicast streams are easier to reason about than one flood.

Where the recorder sits

Put the recorder on the surveillance VLAN next to the cameras, not in the crew network with a second NIC. Dual-homed recorders are the usual cause of "the cameras are isolated but the traffic still leaks" — the second interface bridges the VLANs back together at layer 2 unless it is configured as a routed client with a default gateway that goes nowhere useful.

Remote viewing is then a deliberate hole: one firewall rule, one port, one account. Deliberate is the operative word.

Checklist for the drawing and the yard

  1. 01VLAN boundaries follow function (surveillance / content / data / management)
  2. 02Inter-VLAN routing only for documented service pairs
  3. 03PoE budget computed from datasheet peak draw + 20%, with headroom
  4. 04IGMP snooping enabled on every switch in the IPTV path; one querier
  5. 05Recorder single-homed on the surveillance VLAN
  6. 06Remote access as one explicit rule, not a dual-homed recorder

Questions on this note

Network segregation

Do I need a layer-3 switch?+

Only if something has to route between VLANs — a monitoring client reaching the NVR, for example. A layer-2 switch with a single router or firewall doing inter-VLAN routing is enough on most vessels, and easier to document.

Can the TV and the cameras share one switch?+

Yes, with VLANs and a PoE budget that covers the cameras. What they should not share is a broadcast domain or a multicast scope.