Endpoint Protection

 View Only
Back to discussions
Expand all | Collapse all

Check which clients are downloading full.zip

  • 1.  Check which clients are downloading full.zip

    Posted Aug 03, 2012 01:04 PM

    Team, is there a way to check which clients are downloading the full.zip file? In SEPM logs somewhere?

    I have roughly 25,000 clients so checking the client itself is not an option.

    SEPM is at 12.1 RU1

    Is this at all possible?

    Thanks for any feedback.

    -kt



  • 2.  RE: Check which clients are downloading full.zip

    Posted Aug 03, 2012 01:37 PM

    Using Sylink monitor on Client machine will gives us a idea

    it should show something similar to

    content/{D3769926-05B7-4ad1-9DCF-23051EEE78E3}/110211001/Full.zip



  • 3.  RE: Check which clients are downloading full.zip

    Posted Aug 03, 2012 01:38 PM

    you can download it from here

    http://www.symantec.com/business/support/index?page=content&id=TECH103369

    and then upload the logs in txt format



  • 4.  RE: Check which clients are downloading full.zip

    Posted Aug 03, 2012 01:39 PM

    There is a cache where the client keeps track of whatever it is currently supposed to be updating from the SEPM.

    On older versions of the SEP client (Pre-RU6 MP2) this cache is not cleared when something server side changes, only when the update finishes downloading.

    So, in essence, your clients are stuck downloading that until either they are finished, or something clears that cache.

    As a test, on one machine do the following:

    1) Stop SMC
    2) Delete the Luinfo.dat from the [SEP Client Install]\liveupdate
    3) Start SMC

    check to see if the client re-requests that full.zip.

     



  • 5.  RE: Check which clients are downloading full.zip

    Posted Aug 03, 2012 01:40 PM

    Alternate option Configure GUP if its not present in your Network for LU distribution might help



  • 6.  RE: Check which clients are downloading full.zip

    Posted Aug 03, 2012 01:46 PM

    I don't think that it is possible to  check which clients are downloading the full.zip file from In SEPM logs somewhere.

    As suggested above from the clients side you can do that uisng the sylink log.



  • 7.  RE: Check which clients are downloading full.zip
    Best Answer

    Posted Aug 03, 2012 01:48 PM

    I use Wireshark.

    Install it on your SEPM and begin capturing packets. Set a display filter of:

    (((frame matches "\.[Ff][Uu][Ll][Ll][.][Zz][Ii][Pp]" ) && (tcp.srcport == 8014)) )

    Any clients that show up in the packet list window should be those that are downloading the full.zip file. You can right click on any of the packets and select "Follow TCP Stream" to see the client/server communication. Client is in red and server is in blue.



  • 8.  RE: Check which clients are downloading full.zip

    Posted Aug 03, 2012 01:56 PM

    Checking individual clients is just not an option for me.



  • 9.  RE: Check which clients are downloading full.zip

    Posted Aug 03, 2012 02:00 PM

    I wrote a simple Snort signature to detect clients that were corrupt and trying to download the Full.zip multiple times.  You can change it just to look for a Full.zip download without a threshhold set.

     

    alert tcp $HOME_NET any -> X.X.X.X 8014 (msg:"Possible Symantec Client Corruption";flow:established,to_server;content:"Full.zip";threshold: type both, count 2, seconds 9000, track by_src;classtype:unknown;sid:1081209192;rev:1;)
     



  • 10.  RE: Check which clients are downloading full.zip

    Posted Aug 03, 2012 02:38 PM

    Great Innovation.

    I would give you one more way, open the trace is Network Monitor and apply the filter

    description.contains("Full.Zip")

    All the  clients that show up in the packet list window should be those that are downloading the full.zip file. You can right click on any of the packets and select "Follow TCP Stream" to see the client/server communication.

     



  • 11.  RE: Check which clients are downloading full.zip

    Posted Aug 03, 2012 04:14 PM

    Yes, there is a way to do this.  Export the following log:

    • Log type: System
    • Log content: Client Activity

    Once exported, filter the log thus only showing the Content Update Server within Event Type and filter the Severity to only show Informational logs.  Now filter the Event Description column to only show Full.zip ( I used a text filter followed by the contains filter ).  After which you will only have the clients which have downloaded the entire Full.zip file.  Success!!

     

    Hope that this helps.



  • 12.  RE: Check which clients are downloading full.zip

    Posted Aug 06, 2012 08:21 AM

    Can this signature be formatted for use in the custom IPS section of SEPM?