The SEPM updates the list of GUPs to reflect which GUPs meet the configured criteria every time the GUP checks in.
The SEPM stores this list of GUPs in the following locations:
32bit Servers
C:\Program Files\Symantec\Symantec Endpoint Protection Manager\data\outbox\agent\gup
64Bit Servers
C:\Program Files(x86)\Symantec\Symantec Endpoint Protection Manager\data\outbox\agent\gup.
This information is also stored in a database table. The file, globallist.xml, is protected from tampering via checksum.
The list is published with GUP IP addresses in ascending order.
The clients run a routine called GetGUPList (viewable in sylink.log) that gets the current list of GUPs whenever they need a content update.
The client applies a “Network Subnet Match” filter to the IP address information in the GUP list. This filter is constructed using each of the clients network interfaces to compare subnet masks.
Any GUPs with a subnet mask matching the clients are placed in a new local GUP list created by the client. This new 'local' list is stored in RAM only.
Note: The local GUP list is in ascending order which means that a predefined GUP will always be last on the list, preventing unnecessary WAN traffic.
Clients will receive the list of GUPs in a file called globallist.xml.