Endpoint Protection

Hello Everybody,

I want to know how the sep 12.1.5 client takes incremental content updates from GUPs & symantec liveupdate server(via internet) & in which condition it will approach to GUPs & symantec liveupdate server(via internet) for incremental and full content updates. Please see the below queries also:

1. Would the sep 12.1.5 client can also download the incremental content updates(deltas) from symantec liveupdate server(via internet).

2. Would the sep 12.1.5 client can also download the incremental content updates(deltas) from GUPs.

Thanks in advance.

Regards

Hi,

Basically it's depends upon how many content revisions are stored in the SEPM.

If SEPM has already downloaded the requested defintions it will pass on delta updates or else it will download full.zip to pass on.

Can refer these articles: With default LiveUpdate content revision settings configured within the Symantec Endpoint Protection Manager, clients are downloading full definition updates instead of delta updates

• http://www.symantec.com/docs/TECH94916

When will a client download a full definition set from a Symantec Endpoint Protection Manager or Group Update Provider?

• http://www.symantec.com/docs/TECH131528

This article explains it

http://www.symantec.com/docs/TECH131528

1. Would the sep 12.1.5 client can also download the incremental content updates(deltas) from symantec liveupdate server(via internet).

If the SEP client downloads content from LU Symantec servers, it will try to negotiate a minimal download. That should work as long as the age of the client content is not too old.

2. Would the sep 12.1.5 client can also download the incremental content updates(deltas) from GUPs.

Yes. The GUP is a dumb slave of the SEPM and is delivering all types of content the SEPM is providing too (except of client upgrades).

Maybe a new feature of SEP 12.1.6 is interesting for you: It's possible to allow the clients to get delta files from the Symantec LU server if the SEPM is only able to deliver full content files.

About updates downloaded from Symantec Liveupdate Server (Internet):
This is always a full definition (except 12.1.6, where the client can be let to download smaller updates from Symantec Liveupdate Server).

About updates downloaded from SEPM:
I hope that you are already aware that the SEPM can be set to keep older definition revisions. The purpose of keeping the older revisions is to compare the latest revision with the older revision to create a differential update, on request by a SEP client.
On every heartbeat (connection) between the SEP client and SEPM, the client receives the details of the latest definition available with SEPM. If the client sees that there is a newer revision available in SEPM, then the client sends a request to SEPM asking for a link from where it can download the update (along with that the details of the revision that is currently installed in the client is also sent to the SEPM). The SEPM will check if the revision that is currently installed in the client is part of its definition store. If YES, the SEPM compares it with the latest revision to create a differential update and then creates a link (depending on whether the client is set to download updates from SEPM or GUP) and sends the link to the client. If NO, the SEPM won't be able to create a differential update as the current revision on the client si not available in SEP for comparission with the latest revision to create differential update. Hence the SEPM sends a link of the FULL.zip to the client.

About updates downloaded from GUP:
The GUP is just a medium between the SEP clients and SEPM. GUP doesn't have the capablity to create or merge differential updates. The Advantage of using GUP that it helps in avoiding multiple downloads of the same update file.