Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

How much bandwidth is used by a SEP Client in One day ?

Created: 11 Sep 2009 • Updated: 28 Nov 2010 | 18 comments
Language Translations
P_K_'s picture
+21 21 Votes
Login to vote
How much bandwidth is used by a SEP Client in One day ?
 
Inroder to calculate the bandwidth used by a SEP Cleint When it communicates with SEPM , first we need to find , what are the components or contents that uses bandwidth and how much bandwidth they use.
 
 
 
Content type
Size of Package
Heartbeat
 2 KB/s to 3 KB/s per heartbeat.
Policies
20 KB to 80 KB.
IPS Signature Updates
50 KB and 100 KB
AV Signatures
50 KB to 100 KB (daily)
Logs
10 KB
 
 
( From the above Polilcy and IPS Signatures are not passed on a daily basis)
 
So lets take a scenario. We have a Client whose Heartbeat is set at 5 minutes’  and It takes Updates from the SEPM once in a day.
 
SO, In 24 hours it the number of  heartbeats = 12*24 = 288
 
Now, Size of package for 288 Heartbeats      =   864 KB 
Size of Package AV signatures                     =   100 KB
Logs                                                          =   10 KB
 


Total size of package (Traffic)                     =   974 KB ~ 1 MB
 
So in an IDEAL scenario   the traffic generated for a client to and from SEPM is nearly 1 MB in One day.

Comments 18 CommentsJump to latest comment

jeffwichman's picture

Parchand,

I like the article.  However this ideal scenario would need clients connected 24 x 7.  I'm saying this because the default number of revisions in SEPM is set to 3.  That means you only have two revisions to build delta packages.  If a client is off-line for more than 24 hours (assuming SEPMS grab three updates per day) a client will be required to download the full.zip file increasing the download to over 80MB.  Here's my article on troubleshooting network bandwidth related issues with definition file updates which might come in handy for people.

https://www-secure.symantec.com/connect/articles/sepm-sep-client-bandwidth-troubleshooting

Cheers.

Jeff

+5
Login to vote
DGL-Mike's picture

Hi Prachand,

I don't get it...by my reckoning you've worked out the total number of heartbeats for 5 clients as a 5 minute heartbeat makes 12 per hour so should it not just be 12 * 24 for one client??? Also, I thought the Client uploads its logs on each heartbeat making it:
 
(2kb + 10kb) * 12 heartbeats * 24 hours * + 100kb defs (assuming 1 content update per day)


???

Regards,

Mike

0
Login to vote
P_K_'s picture

Hi Mike , The data is for one client and not 5 clients
Also the calculation also  has the logs  data added to it too.

 

Now, Size of package for 288 Heartbeats = 864 KB 
Size of Package AV signatures                     =   100 KB
Logs                                                                 =    10 KB

( It is an approximate data in an IDEAL senario)

MCT MCSE-2012 Symantec Technical Specialist (SCTS)

+3
Login to vote
Symantec World's picture

I think instead of configure Replicatiom partners we can configure GUP.

Any suggestion?

Regards, M.R

0
Login to vote
P_K_'s picture

Yes , GUP will defintly save a alot of bandwidth

MCT MCSE-2012 Symantec Technical Specialist (SCTS)

+2
Login to vote
DanielW 2's picture

So does anyone know how switching between the SEPM updates and Symantec's Live update affects bandwidth.  It used to be that connecting into Live Update would break how the xDeltas would work.  In other words, it would get the full update from Symantec (live update didn't provide the diff).  Then the next time it checked into the SEPM and got new update there, it would have to get the full update as well.  Has this changed?

It would seem that it was in Symantec's best interest to make the two models compatible (save them some bandwidth) but I can't find anything about it.

0
Login to vote
DGL-Mike's picture

Hi Prachand,

Are you saying 10kb of logs per day or per heartbeat?

Also, this figure would obviously depend on which logs are being uploaded to the SEPM as defined in the Log Handling section of the AV policy and in the Client Log settings on the client group, could you let me know which AV events from the Log Handling tab and which logs set to upload to SEPM on the client group would be included in the 10kb logs figure?

Either way I still don't get it...maybe I'm being a bit dim but your calculation doesn't look right to me?

 
Content type
Size of Package
Heartbeat
 2 KB/s to 3 KB/s per heartbeat.
Policies
20 KB to 80 KB.
IPS Signature Updates
50 KB and 100 KB
AV Signatures
50 KB to 100 KB (daily)
Logs
10 KB

SO, In 24 hours it the number of  heartbeats = 5*12*24 = 1440
 
Now, Size of package for 1440 Heartbeats = 7200 KB 
Size of Package AV signatures                     =   100 KB
Logs                                                                 =    10 KB
 
Total size of package (Traffic)                     =   7310 KB = 7.1MB

Please, please do correct me here if I'm wrong but using your best case scenario figures above with no IPS or policy updates:

With a heatbeat interval of 5 mins the number of heartbeats per hour = 60 mins / 5 mins = 12 heartbeats per hour

Therefore in 24 hours the number of heartbeats = 12 heartbeats per hour x 24 hours = 288 heartbeats per day

Assuming that the client uploads 10kb of logs upon each heartbeat then:

The size of the daily heartbeat package = 2kb per heartbeat + 10kb of logs per heartbeat x 288 heartbeats per day = 3456Kb per day

Add to that figure 100kb of AV defs = 3456kb daily heartbeat package + 100kb AV defs = 3556kb or 3.5 Mb per client per day

I need to get my head round this as I thought I'd worked it out right, can you clarify your calculations for me and/or correct mine please?

Thanks in advance,

Mike

+2
Login to vote
Siddh's picture

Thaks, very good infor you have given

Regards,

Siddhesh

If this response answers your query, please mark it as a solution

Test your backups to make sure they will get you back up! Because a backup failing is just as bad as failing to backup!

0
Login to vote
SymSEP's picture

If I am not wrong the last time when i had seen this kb the  the traffic generated for a client to and from SEPM is nearly 7 MB in One day. ((IdIf i ndsjsbfd

Has anything changed

0
Login to vote
_Swami_'s picture

I have sent you a PM about a query ,please respond

0
Login to vote
zhitenev's picture

Prachand, hello

Could you please help with answering such question: if SEP clients are configured to download updates from "a Live Update server" will they be using delta updates, or each time full blown 140 MB update will get downloaded?

Also, if delta updates are indeed supported (which I would expect), do you happen to know how many days do LU servers keep (in other words, how many days should a client stay without updates to be forced to download full size defenitions file)?

 

Thanks!

+1
Login to vote
P_K_'s picture

The Client will get the delta.

What I know if the client has not been connected to LU (Symantec Live Update Server) for 30 days it will download the full defs

MCT MCSE-2012 Symantec Technical Specialist (SCTS)

+2
Login to vote
NMG's picture

is it true for sep 12 also?

0
Login to vote
Mohan Babu's picture

Yes it is appicable for both SEP11.x & SEP12.1 clients....

Mohan Babu

moglie20@gmail.com

+91 9884382160

Your satisfaction is very important to us.If you find above information helpful or it has resolved your issue...please mark it accordingly :)

0
Login to vote
pete_4u2002's picture

note the definition size has been increasing becuase of the increase in the threat landscape.

+1
Login to vote
USECredit's picture

Indeed. Symantec has become the new presumed bandwidth hog at my company. We have 5 branches, the fastest of which has only a 3Mbps connection to our main office. We have a max of 7 PC's at the largest branch, so it doesn't make sense to use GUP.

But something is taking so much bandwidth their phones don't work on occasion. :/

0
Login to vote
P_K_'s picture

Take a netwok trace at the time of the issue and  check on which port the traffic is high

MCT MCSE-2012 Symantec Technical Specialist (SCTS)

+1
Login to vote