Endpoint Protection

Just to be sure about it: does the LUA (2.3.2) will provide delta updates to the clients (SEP in this case)?

Yes, I know how the delta process works (number of revisions stored and so on), I just want to know if that mechanism (that I know the SEPM provides) is provided by the LUA too.

I think that the answer is yes but... just to be sure.

Yes, check this article specifically under bandwidth saving:

When to use LiveUpdate Administrator

One thing to note that the LUA mechanism for creating deltas is bit different than the one used on SEPM - as a result deltas from LUA will always be larger in size than the ones created on SEPM. There is currently an idead posted on connect to change that:

https://www-secure.symantec.com/connect/ideas/enable-liveupdate-administrator-2x-create-delta-definitions-sep-clients

As per Mick comments in:

https://www-secure.symantec.com/connect/forums/sep-average-update-size

"In most circumstances it is best for the SEPM to handle this job, as the technology that it uses to generate delta defs for the clients results in smaller custom-built differential delta files being sent to each endpoint client.  The SEP clients get exactly what they need, and no larger.
The LUA server just stores and passes on the same larger incremental "current defs" that are on the Internet.  This keeps them up-to-date just as effectively, but may use more network bandwidth."

Is it possible to know "exactly" why the delta generated by SEPM is smaller than the delta generated by LUA?

SEPM provides exactly what clients need... from one def to another one, isn't this exactly the difference between the two?

SEPM generates the delta definitions on the basis of stored defs revisions in the database - so the delta here is differential. For that to work SEPM needs two defs revision stored - one initial and then the latest target def => delta then being simply content that is existing in the latest defs but not in the initial one - as you mentioned the "difference between the two".

Example:

* SEPM definitions:

- Definition Revision 1

- Definition Revision 2

- Definition Revision 3

-> possible deltas:

- Delta A - difference between Revision 1 and 2

- Delta B - difference between Revision 2 and 3

- Delta C - difference between Revision 1 and 3 - this one will be bigger than A and B because it covers all the differences between 3 revisions

= differential

LUA on the other hand doesn't really create any deltas on its own - these are passed down the line from the internet liveupdate symantec servers and stored on LUA. These are larger than SEPM deltas because they are incremental and not differential - they contain all the "differences = new signatures" between the initial Hub definition and the target current definition.

Example:

* Definitions from Symantec/LUA:

- AV HUB/Full Definition

- Definition 1

- Definition 2

-> possible deltas:

- Delta 1 - difference between HUB and 1

- Delta 2 - difference between HUB and 2 etc.

= incremental

The main difference here is then that SEPM kind of takes into consideration what revision of the definition is already on the client and creates the delta to it. LUA is not concerned about that - provides simply the latest revision that will be appropriate for the client.

I hope I didn't make any errors in the above description and examples.