Hi All,

We wanted to throttle bandwidth on core router for which requirement of bandwidth is needed to allocate to SEPM.

See this thread

https://www-secure.symantec.com/connect/forums/sepm-120-bandwidth-throttling

No such option available for SEP 12.1

wrt to logs When there are no new client-side logs to upload to the management server, or policy or content to download from the server, the size of the Symantec Endpoint Protection client heartbeat is between 3KB and 5KB. When all client protection technologies are enabled and the maximum level of client logging is enabled (with the exception of packet-level firewall logging, which is not recommended in production environments), the size of a typical heartbeat is between 200 KB and 300 KB.

wrt to updates

I think you both not understand what I want here.......

I need bandwidth requirement for SEPM to allocate to download definition from Internet so the same can throttle at router end.

This is not relates to server client bandwidth throttling.

There is no Specify bandwidth requirement available for downloading defination for internet.

You can check bandwidth requirement SEPM to SEP client

Symantec Endpoint Protection Sizing and Scalability Best Practices White Paper

IF you are using LUA for downloading defination

When to use LiveUpdate Administrator

Manager can run liveupdate continiously,( approx every 15 mins) or every 4 hours or based on schedule.

Exact size of defs is not know as it varies.

from the LU tab select only whats needed , for ex, if you dont have NTP component installed do not download the defs.

this document might be of some help

Managing content updates

http://www.symantec.com/business/support/index?page=content&id=HOWTO80806#v16999196

Thumbs up to the above posts 

As the others have mentioned, there's no specific bandwidth requirement for the SEPM to the Internet, as there is no constant activity.  The majority of any SEPM -> Internet traffic will be definition downloads.  The schedule is something you manage of course, the size of the content can be guess-timated from the full def downloads available from the below:

http://www.symantec.com/security_response/definitions.jsp

Add a (very) little extra for the Licensing, Threatcon, and "Defs from Symantec" updates when on the console and you're done.

Don't forget however, that SEP clients also connect directly out to the internet for Insight lookups and anonymous data submissions.  More info on the amount of network load this generates can be found in the Insight FAQ below:

http://www.symantec.com/docs/TECH183109