Endpoint Protection

Need to resolve if the traffic I recently sniffed is legit....

Should SEPM v11.x be pulling data from IP's on cachenetworks.com's (69.22.154.x) block?

Thanks!

http://www.symantec.com/business/support/index?page=content&id=TECH97397

Looks to be content updates via LiveUpdate.

Hello Allen ,

Rafeeq has mentioned it correct however if you dont want your Sep manager to get updates directly from external source .

Then you can Introduce Liveupdate Administrator in your envoirnment .

http://www.symantec.com/business/support/index?page=content&id=TECH102701

Hello,

Symantec Endpoint Protection uses the Symantec Liveupdate Servers to update itself via the servers as below:

http://akamai.net
http://liveupdate.symantecliveupdate.com*
http://symantec.com*
http://symantec.symantecliveupdate.com*

As these servers are located across the world, they would use such Public IP addresses.

Incase, you feel you would like to keep a check or monitor the same, make sure you create an exceptions for the above sites and block others.

Liveupdate is hosted with Akamai. I am not familiar with cachenetworks.

Ok, yes, it is Akamai, I was mistaken.

Many thanks to everyone!  :)