Endpoint Protection

Can we have any updated statistics for 12.1.6 , that would really be wonderful . If anyone can provide any statistics. Regards 

Not likely anymore

Hi,

Is this valid for SEPM 12 as well?

-Jimmy

Take a netwok trace at the time of the issue and  check on which port the traffic is high

Indeed. Symantec has become the new presumed bandwidth hog at my company. We have 5 branches, the fastest of which has only a 3Mbps connection to our main office. We have a max of 7 PC's at the largest branch, so it doesn't make sense to use GUP.

But something is taking so much bandwidth their phones don't work on occasion. :/

note the definition size has been increasing becuase of the increase in the threat landscape.

Yes it is appicable for both SEP11.x & SEP12.1 clients....

is it true for sep 12 also?

The Client will get the delta.

What I know if the client has not been connected to LU (Symantec Live Update Server) for 30 days it will download the full defs

Prachand, hello

Could you please help with answering such question: if SEP clients are configured to download updates from "a Live Update server" will they be using delta updates, or each time full blown 140 MB update will get downloaded?

Also, if delta updates are indeed supported (which I would expect), do you happen to know how many days do LU servers keep (in other words, how many days should a client stay without updates to be forced to download full size defenitions file)?

 

Thanks!

I have sent you a PM about a query ,please respond

If I am not wrong the last time when i had seen this kb the  the traffic generated for a client to and from SEPM is nearly 7 MB in One day. ((IdIf i ndsjsbfd

Has anything changed

Hi Prachand,


Are you saying 10kb of logs per day or per heartbeat?

Also, this figure would obviously depend on which logs are being uploaded to the SEPM as defined in the Log Handling section of the AV policy and in the Client Log settings on the client group, could you let me know which AV events from the Log Handling tab and which logs set to upload to SEPM on the client group would be included in the 10kb logs figure?

Either way I still don't get it...maybe I'm being a bit dim but your calculation doesn't look right to me?

Content type	Size of Package
Heartbeat	2 KB/s to 3 KB/s per heartbeat.
Policies	20 KB to 80 KB.
IPS Signature Updates	50 KB and 100 KB
AV Signatures	50 KB to 100 KB (daily)
Logs	10 KB

Please, please do correct me here if I'm wrong but using your best case scenario figures above with no IPS or policy updates:

With a heatbeat interval of 5 mins the number of heartbeats per hour = 60 mins / 5 mins = 12 heartbeats per hour

Therefore in 24 hours the number of heartbeats = 12 heartbeats per hour x 24 hours = 288 heartbeats per day

Assuming that the client uploads 10kb of logs upon each heartbeat then:

The size of the daily heartbeat package = 2kb per heartbeat + 10kb of logs per heartbeat x 288 heartbeats per day = 3456Kb per day

Add to that figure 100kb of AV defs = 3456kb daily heartbeat package + 100kb AV defs = 3556kb or 3.5 Mb per client per day


I need to get my head round this as I thought I'd worked it out right, can you clarify your calculations for me and/or correct mine please?

Thanks in advance,

Mike

So does anyone know how switching between the SEPM updates and Symantec's Live update affects bandwidth.  It used to be that connecting into Live Update would break how the xDeltas would work.  In other words, it would get the full update from Symantec (live update didn't provide the diff).  Then the next time it checked into the SEPM and got new update there, it would have to get the full update as well.  Has this changed?

It would seem that it was in Symantec's best interest to make the two models compatible (save them some bandwidth) but I can't find anything about it.

Yes , GUP will defintly save a alot of bandwidth

I think instead of configure Replicatiom partners we can configure GUP.

Any suggestion?

Hi Mike , The data is for one client and not 5 clients
Also the calculation also  has the logs  data added to it too.

 

Hi Prachand,

I don't get it...by my reckoning you've worked out the total number of heartbeats for 5 clients as a 5 minute heartbeat makes 12 per hour so should it not just be 12 * 24 for one client??? Also, I thought the Client uploads its logs on each heartbeat making it:
 
(2kb + 10kb) * 12 heartbeats * 24 hours * + 100kb defs (assuming 1 content update per day)

Parchand,

I like the article.  However this ideal scenario would need clients connected 24 x 7.  I'm saying this because the default number of revisions in SEPM is set to 3.  That means you only have two revisions to build delta packages.  If a client is off-line for more than 24 hours (assuming SEPMS grab three updates per day) a client will be required to download the full.zip file increasing the download to over 80MB.  Here's my article on troubleshooting network bandwidth related issues with definition file updates which might come in handy for people.

https://www-secure.symantec.com/connect/articles/sepm-sep-client-bandwidth-troubleshooting

Cheers.

Jeff