Hi,
The SEPM checks for new definitions from a Symantec LiveUpdate Server by default every 4 hours. Symantec typically releases 1 to 3 sets of Virus and Spyware definitions a day. If the manager only maintains 3 content revisions of definitions, then a client that has been off for more than a single day will most likely require a full definition package which is usually around 120 MB in size.
If the SEPM is configured to keep 10 content revisions of definitions, then a client can be off up to 3 days before the SEPM will need to send a full package to the client. If the client requests an update within that window, then it would be able to receive a delta package which would only contain the changes that occurred over the last 3 days and the size of which would be significantly smaller.
Refer this article:
How are virus definitions distributed from the Symantec Endpoint Protection Manager?
http://www.symantec.com/docs/HOWTO53175