We are running SEP 11 MR6 on all windows XP workstation and Win 2003 R2 servers
We only have on SEPM server, 400 clients with only AV installed no network and proactive protection installed.
This just happened about two months
We have 19 branches, each branch has T 1 line, pretty fast but strange things are
1) We get very slow connection 1500 --3000 ms after every holiday (2-3 long weekends) for particular branch and not all branch offices
2) each branch has 8-10 workstations and most of PCs are on all the time (reboot it daily or weekly)
We use sniffer to capture some problem workstations and see more traffic coming from SEPM server.
It seems download defination files.
If we shut down SEPM server, the traffic is very light and no slowness.
We could not figure out whether symantec changed some download format for AV def files
Any help will be appreciated.