Video Screencast Help

Pull mode & push mode

Created: 18 Nov 2011 • Updated: 13 Apr 2012 | 6 comments
This issue has been solved. See solution.


Which mode is a better communication for  600 clients SEPM setup in DHCP LAN settings?

Comments 6 CommentsJump to latest comment

pete_4u2002's picture

I would say pull mode, though the clients are less but 600 clients connecting to SEPM continously will downgrade performance of the SEPM.

kp.ashok87's picture

Downgrade means, console speed or total SEPM and database downgrade ?...becuse when i used to open the console on morning takes some time...

pete_4u2002's picture

higher CPU, memory. IO on the SEPM machine.

Mithun Sanghavi's picture


You could also have a Look at this Link.

How To Optimize Endpoint Protection for Branch Offices using GUPs, Load Balancing, and Location Awareness

You can have those machines in a separate group with their communication policy set to pull mode.

  • Push mode

    The client establishes a constant HTTP connection to the server. Whenever a change occurs with the server status, it notifies the client immediately.

  • Pull mode

  • The client connects to the server periodically, depending on the frequency of the heartbeat setting. The client checks the status of the server when it connects.

    Because of the constant connection, push mode requires a large network bandwidth. Most of the time you can set up clients in pull mode.

  • Steps to change the communication mode in client groups

    Configuring communication settings for a location

    Configuring push mode or pull mode to update client policies and content

    Hope that helps!!

    Mithun Sanghavi
    Associate Security Architect

    MIM | MCSA | MCTS | STS | SSE | SSE+ | ITIL v3

    Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

    Ajit Jha's picture

    Pull mode will fine good. 


    Ajit Jha

    Technical Consultant

    ASC & STS

    Chetan Savade's picture


    What is the difference between Push and Pull modes when downloading policies and content from the management server?

    Clients that use the Push mode download policies and content as soon as they become available. On push mode an open connection is kept so that the manager can contact the client immediately when data is available. Clients that use the Pull mode download policies and content based on the Heartbeat interval setting, which is set to 5 minutes by default. Because of the greater network bandwidth that is used with the push mode, it is recommended more for small and medium-sized networks.

    Push Mode is recommended for small & medum-sized networks.

    Monitor the situation after keeping push mode in environment. If you observed in performance issue change it to Pull mode.

    Which Communication Ports does Symantec Endpoint Protection 11.0 use?  

    Monitor traffic on ports listed above.

    I hope it will help you !!

    Chetan Savade
    Sr.Technical Support Engineer, Endpoint Security
    Enterprise Technical Support

    Don't forget to mark your thread as 'SOLVED' with the answer that best helps you.<