This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Stand Alone Endpoint Security and Control Not updating

I am attempting to roll out some Windows Surface Pros with Sophos Endpoint Security and Control.

It appears to install fine, but will then not update.

I just get ERROR: Download of Sophos Endpoint Security and Failed from Sophos Server.

I am using the same install files that I have used successfully previously and I have checked that the software still updates on other devices.

The username and password are again the same as used on previous installs and our license is up to date.

I have also tried on a different network (ie using my phone as a hot spot)

Any advice would be gratefully received

This thread was automatically locked due to age.

Parents

0 QC over 6 years ago

Hello Tania Keenan1,

could you post one complete update cycle from the ALUpdate log (in %ProgramData%\Sophos\AutoUpdate\Logs\)?

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 Tania Keenan1 over 6 years ago in reply to QC
Cancel
Vote Up 0 Vote Down

Cancel
0 Tania Keenan1 over 6 years ago in reply to QC

This was taken from Google.

How do I get the information you need?
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 6 years ago in reply to Tania Keenan1

Hello Tania Keenan1,

I'm using Firefox, but guess Chrome is similar. I open a new tab or window, F12 (Developer Tools), then paste the URL and press Enter/GoTo.

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 Tania Keenan1 over 6 years ago in reply to QC

Yes, thats what I did, thats how I got the last screenshot.

If I run it on my own PC I get this

If I run the same thing on the Pro I get

What I cant identify is how to show you the "headers"?
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 6 years ago in reply to Tania Keenan1

Hello ,

you should be able to see the headers by clicking on the Name).

The request for the .dat document is not in the Pro screenshot though, it shows as far as I can tell an OWA login (and furthermore the Status is given as 242). What happens if you request some other .dat - on of those that are already in the Warehouse?

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 Tania Keenan1 over 6 years ago in reply to QC

Morning,

If I request one of the other .dat files, the headers look like this
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 6 years ago in reply to Tania Keenan1

Hello Tania Keenan1,

both look ok. But when you request the 0221704eeba4f0491dbe607ffa854077x000.dat from the Pro you don't get a response?

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 Tania Keenan1 over 6 years ago in reply to QC

The Site cant be reached page was just what was on there anyway, The page itself didnt change, but the .dat file did download..
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 6 years ago in reply to Tania Keenan1

Hello Tania Keenan1,

the installer still fails with the same error for the same file? Did I understand correctly that you can download the "problem" 0221... .dat with a browser on the Pro and both screenshots are from the Pro?

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 Tania Keenan1 over 6 years ago in reply to QC

Yes the installer still fails on that .dat file.

Yes I can download it.

Yes the screenshots are from the Pro.

I have 16 of these the roll out and have the same issue on the first 5 so far.
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 6 years ago in reply to Tania Keenan1

Hello Tania Keenan1,

weird. Wonder if it's a red herring.
AFAIK AutoUpdate's downloader still uses HTTP so it should be possible to capture the traffic with Wireshark using tcp port 80 (optionally with an additional and host 2.19.60.128) as capture filter. The HTTP data can be viewed with Analyze → Follow → HTTP stream.

Christian
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 QC over 6 years ago in reply to Tania Keenan1

Hello Tania Keenan1,

weird. Wonder if it's a red herring.
AFAIK AutoUpdate's downloader still uses HTTP so it should be possible to capture the traffic with Wireshark using tcp port 80 (optionally with an additional and host 2.19.60.128) as capture filter. The HTTP data can be viewed with Analyze → Follow → HTTP stream.

Christian
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Tania Keenan1 over 6 years ago in reply to QC

Fullscreen sophos capture.txt Download

GET /update/2/64/2645f66c4fa03b6ea0a6427c734db1cb.dat HTTP/1.1
Connection: Keep-Alive
Accept: text/*, application/*
User-Agent: AutoUpdate/5.2.0.276 SDDS/2.0 (u="7XXXXXXXXX" c="37c99a16-170e-4aab-94ec-f3bf3abc615b" i="")
Host: dci.sophosupd.com

[2920 bytes missing in capture file].
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDrjCCApagAwIBAgIBFTANBgkqhkiG9w0BAQUFADCBhTEnMCUGA1UEAxMeU29w
aG9zIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSIwIAYJKoZIhvcNAQkBFhNzb3Bo
b3NjYUBzb3Bob3MuY29tMRQwEgYDVQQIEwtPeGZvcmRzaGlyZTELMAkGA1UEBhMC
VUsxEzARBgNVBAoTClNvcGhvcyBQbGMwHhcNMDgxMjAxMDAwMDAwWhcNMjQwMTI4
MDAwMDAwWjCBnDEiMCAGA1UEAxMZU29waG9zSW50ZXJtZWRpYXRlRXhwMjAyNDEi
MCAGCSqGSIb3DQEJARYTc29waG9zY2FAc29waG9zLmNvbTEUMBIGA1UECBMLT3hm
b3Jkc2hpcmUxCzAJBgNVBAYTAlVLMRMwEQYDVQQKEwpTb3Bob3MgTHRkMRowGAYD
VQQLExFTb3Bob3NTZWN1cmVCdWlsZDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBAPP2jxQPAX3fGCjB27ca1tLqgvvwbtkpJQ3HBOiDOoshZomCSEhBduTN
KYSXVNS4Ta+shE3G0NRYh0x51xG9I5M79rgebqZrUMm/iHayJu2z8F/Vuc8c2wZP
JFB/PDxgCLTE8XkSm/o56mrS7flWBgcS5odSF7vC21dd/M5B03/DArt9XEk+0bhA
pHDgeS0LYyZrFLg4f8CpQoyTJS4ar4urZJRyhLJbcognr7FA9q7RlGdiwlYh6Upq
ioHIHfVT1j2t6KJCUO/zHowkCE5D5mp/pVG+lSReA6GAgtEFRKOpSGA6OTj3csou
YjFm6hIG/qSBi74uW4dKsfWF1jjYHd0CAwEAAaMQMA4wDAYDVR0TBAUwAwEB/zAN
BgkqhkiG9w0BAQUFAAOCAQEAGPIEHpFysO7eBpZDnTMglK0Z4Z4Mq78KXT8d8S+A
8Ds6zuGoT3So0tsI1DiVPodZ8Un3y4rJ4NnO1ueXMwWBvKQVQu7kcBH4d50m/yb5
rZkdg3qIyevIsNFb5AQ2wuM0/LT2KTmYgv09Jy/D58XoKSMtnU9dT57sgwZ0DHE1
RKUUuWceStccPDViBzVGKWgNgNSlzFFIqHYwyohKidh2IFQKw18p+qcAEwcS9KP/
09e1jqpl8FzfxpSfXV+Djouudu9H75mkvvYPoUuZeFeYKrEgFLq9IuDqvflBgL+/
fS8PCgvVMn5tAKMdsV+AOGZ/Shmmo3aLs6nfNyooDsO0Aw==
-----END CERTIFICATE-----
GET /update/2/64/2645f66c4fa03b6ea0a6427c734db1cb.dat HTTP/1.1
Connection: Keep-Alive
Accept: text/*, application/*
User-Agent: AutoUpdate/5.2.0.276 SDDS/2.0 (u="7XXXXXXXXX" c="37c99a16-170e-4aab-94ec-f3bf3abc615b" i="")
Host: dci.sophosupd.com

[2920 bytes missing in capture file].
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDrjCCApagAwIBAgIBFTANBgkqhkiG9w0BAQUFADCBhTEnMCUGA1UEAxMeU29w
aG9zIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSIwIAYJKoZIhvcNAQkBFhNzb3Bo
b3NjYUBzb3Bob3MuY29tMRQwEgYDVQQIEwtPeGZvcmRzaGlyZTELMAkGA1UEBhMC
VUsxEzARBgNVBAoTClNvcGhvcyBQbGMwHhcNMDgxMjAxMDAwMDAwWhcNMjQwMTI4
MDAwMDAwWjCBnDEiMCAGA1UEAxMZU29waG9zSW50ZXJtZWRpYXRlRXhwMjAyNDEi
MCAGCSqGSIb3DQEJARYTc29waG9zY2FAc29waG9zLmNvbTEUMBIGA1UECBMLT3hm
b3Jkc2hpcmUxCzAJBgNVBAYTAlVLMRMwEQYDVQQKEwpTb3Bob3MgTHRkMRowGAYD
VQQLExFTb3Bob3NTZWN1cmVCdWlsZDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBAPP2jxQPAX3fGCjB27ca1tLqgvvwbtkpJQ3HBOiDOoshZomCSEhBduTN
KYSXVNS4Ta+shE3G0NRYh0x51xG9I5M79rgebqZrUMm/iHayJu2z8F/Vuc8c2wZP
JFB/PDxgCLTE8XkSm/o56mrS7flWBgcS5odSF7vC21dd/M5B03/DArt9XEk+0bhA
pHDgeS0LYyZrFLg4f8CpQoyTJS4ar4urZJRyhLJbcognr7FA9q7RlGdiwlYh6Upq
ioHIHfVT1j2t6KJCUO/zHowkCE5D5mp/pVG+lSReA6GAgtEFRKOpSGA6OTj3csou
YjFm6hIG/qSBi74uW4dKsfWF1jjYHd0CAwEAAaMQMA4wDAYDVR0TBAUwAwEB/zAN
BgkqhkiG9w0BAQUFAAOCAQEAGPIEHpFysO7eBpZDnTMglK0Z4Z4Mq78KXT8d8S+A
8Ds6zuGoT3So0tsI1DiVPodZ8Un3y4rJ4NnO1ueXMwWBvKQVQu7kcBH4d50m/yb5
rZkdg3qIyevIsNFb5AQ2wuM0/LT2KTmYgv09Jy/D58XoKSMtnU9dT57sgwZ0DHE1
RKUUuWceStccPDViBzVGKWgNgNSlzFFIqHYwyohKidh2IFQKw18p+qcAEwcS9KP/
09e1jqpl8FzfxpSfXV+Djouudu9H75mkvvYPoUuZeFeYKrEgFLq9IuDqvflBgL+/
fS8PCgvVMn5tAKMdsV+AOGZ/Shmmo3aLs6nfNyooDsO0Aw==
-----END CERTIFICATE-----
GET /update/2/64/2645f66c4fa03b6ea0a6427c734db1cb.dat HTTP/1.1
Connection: Keep-Alive
Accept: text/*, application/*
User-Agent: AutoUpdate/5.2.0.276 SDDS/2.0 (u="7XXXXXXXXX" c="37c99a16-170e-4aab-94ec-f3bf3abc615b" i="")
Host: dci.sophosupd.com

[2920 bytes missing in capture file].
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDrjCCApagAwIBAgIBFTANBgkqhkiG9w0BAQUFADCBhTEnMCUGA1UEAxMeU29w
aG9zIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSIwIAYJKoZIhvcNAQkBFhNzb3Bo
b3NjYUBzb3Bob3MuY29tMRQwEgYDVQQIEwtPeGZvcmRzaGlyZTELMAkGA1UEBhMC
VUsxEzARBgNVBAoTClNvcGhvcyBQbGMwHhcNMDgxMjAxMDAwMDAwWhcNMjQwMTI4
MDAwMDAwWjCBnDEiMCAGA1UEAxMZU29waG9zSW50ZXJtZWRpYXRlRXhwMjAyNDEi
MCAGCSqGSIb3DQEJARYTc29waG9zY2FAc29waG9zLmNvbTEUMBIGA1UECBMLT3hm
b3Jkc2hpcmUxCzAJBgNVBAYTAlVLMRMwEQYDVQQKEwpTb3Bob3MgTHRkMRowGAYD
VQQLExFTb3Bob3NTZWN1cmVCdWlsZDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBAPP2jxQPAX3fGCjB27ca1tLqgvvwbtkpJQ3HBOiDOoshZomCSEhBduTN
KYSXVNS4Ta+shE3G0NRYh0x51xG9I5M79rgebqZrUMm/iHayJu2z8F/Vuc8c2wZP
JFB/PDxgCLTE8XkSm/o56mrS7flWBgcS5odSF7vC21dd/M5B03/DArt9XEk+0bhA
pHDgeS0LYyZrFLg4f8CpQoyTJS4ar4urZJRyhLJbcognr7FA9q7RlGdiwlYh6Upq
ioHIHfVT1j2t6KJCUO/zHowkCE5D5mp/pVG+lSReA6GAgtEFRKOpSGA6OTj3csou
YjFm6hIG/qSBi74uW4dKsfWF1jjYHd0CAwEAAaMQMA4wDAYDVR0TBAUwAwEB/zAN
BgkqhkiG9w0BAQUFAAOCAQEAGPIEHpFysO7eBpZDnTMglK0Z4Z4Mq78KXT8d8S+A
8Ds6zuGoT3So0tsI1DiVPodZ8Un3y4rJ4NnO1ueXMwWBvKQVQu7kcBH4d50m/yb5
rZkdg3qIyevIsNFb5AQ2wuM0/LT2KTmYgv09Jy/D58XoKSMtnU9dT57sgwZ0DHE1
RKUUuWceStccPDViBzVGKWgNgNSlzFFIqHYwyohKidh2IFQKw18p+qcAEwcS9KP/
09e1jqpl8FzfxpSfXV+Djouudu9H75mkvvYPoUuZeFeYKrEgFLq9IuDqvflBgL+/
fS8PCgvVMn5tAKMdsV+AOGZ/Shmmo3aLs6nfNyooDsO0Aw==
-----END CERTIFICATE-----
GET /update/2/64/2645f66c4fa03b6ea0a6427c734db1cb.dat HTTP/1.1
Connection: Keep-Alive
Accept: text/*, application/*
User-Agent: AutoUpdate/5.2.0.276 SDDS/2.0 (u="7XXXXXXXXX" c="37c99a16-170e-4aab-94ec-f3bf3abc615b" i="")
Host: dci.sophosupd.com

[2920 bytes missing in capture file].
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDrjCCApagAwIBAgIBFTANBgkqhkiG9w0BAQUFADCBhTEnMCUGA1UEAxMeU29w
aG9zIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSIwIAYJKoZIhvcNAQkBFhNzb3Bo
b3NjYUBzb3Bob3MuY29tMRQwEgYDVQQIEwtPeGZvcmRzaGlyZTELMAkGA1UEBhMC
VUsxEzARBgNVBAoTClNvcGhvcyBQbGMwHhcNMDgxMjAxMDAwMDAwWhcNMjQwMTI4
MDAwMDAwWjCBnDEiMCAGA1UEAxMZU29waG9zSW50ZXJtZWRpYXRlRXhwMjAyNDEi
MCAGCSqGSIb3DQEJARYTc29waG9zY2FAc29waG9zLmNvbTEUMBIGA1UECBMLT3hm
b3Jkc2hpcmUxCzAJBgNVBAYTAlVLMRMwEQYDVQQKEwpTb3Bob3MgTHRkMRowGAYD
VQQLExFTb3Bob3NTZWN1cmVCdWlsZDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBAPP2jxQPAX3fGCjB27ca1tLqgvvwbtkpJQ3HBOiDOoshZomCSEhBduTN
KYSXVNS4Ta+shE3G0NRYh0x51xG9I5M79rgebqZrUMm/iHayJu2z8F/Vuc8c2wZP
JFB/PDxgCLTE8XkSm/o56mrS7flWBgcS5odSF7vC21dd/M5B03/DArt9XEk+0bhA
pHDgeS0LYyZrFLg4f8CpQoyTJS4ar4urZJRyhLJbcognr7FA9q7RlGdiwlYh6Upq
ioHIHfVT1j2t6KJCUO/zHowkCE5D5mp/pVG+lSReA6GAgtEFRKOpSGA6OTj3csou
YjFm6hIG/qSBi74uW4dKsfWF1jjYHd0CAwEAAaMQMA4wDAYDVR0TBAUwAwEB/zAN
BgkqhkiG9w0BAQUFAAOCAQEAGPIEHpFysO7eBpZDnTMglK0Z4Z4Mq78KXT8d8S+A
8Ds6zuGoT3So0tsI1DiVPodZ8Un3y4rJ4NnO1ueXMwWBvKQVQu7kcBH4d50m/yb5
rZkdg3qIyevIsNFb5AQ2wuM0/LT2KTmYgv09Jy/D58XoKSMtnU9dT57sgwZ0DHE1
RKUUuWceStccPDViBzVGKWgNgNSlzFFIqHYwyohKidh2IFQKw18p+qcAEwcS9KP/
09e1jqpl8FzfxpSfXV+Djouudu9H75mkvvYPoUuZeFeYKrEgFLq9IuDqvflBgL+/
fS8PCgvVMn5tAKMdsV+AOGZ/Shmmo3aLs6nfNyooDsO0Aw==
-----END CERTIFICATE-----
GET /update/2/64/2645f66c4fa03b6ea0a6427c734db1cb.dat HTTP/1.1
Connection: Keep-Alive
Accept: text/*, application/*
User-Agent: AutoUpdate/5.2.0.276 SDDS/2.0 (u="7XXXXXXXXX" c="37c99a16-170e-4aab-94ec-f3bf3abc615b" i="")
Host: dci.sophosupd.com

[2920 bytes missing in capture file].
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDrjCCApagAwIBAgIBFTANBgkqhkiG9w0BAQUFADCBhTEnMCUGA1UEAxMeU29w
aG9zIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSIwIAYJKoZIhvcNAQkBFhNzb3Bo
b3NjYUBzb3Bob3MuY29tMRQwEgYDVQQIEwtPeGZvcmRzaGlyZTELMAkGA1UEBhMC
VUsxEzARBgNVBAoTClNvcGhvcyBQbGMwHhcNMDgxMjAxMDAwMDAwWhcNMjQwMTI4
MDAwMDAwWjCBnDEiMCAGA1UEAxMZU29waG9zSW50ZXJtZWRpYXRlRXhwMjAyNDEi
MCAGCSqGSIb3DQEJARYTc29waG9zY2FAc29waG9zLmNvbTEUMBIGA1UECBMLT3hm
b3Jkc2hpcmUxCzAJBgNVBAYTAlVLMRMwEQYDVQQKEwpTb3Bob3MgTHRkMRowGAYD
VQQLExFTb3Bob3NTZWN1cmVCdWlsZDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBAPP2jxQPAX3fGCjB27ca1tLqgvvwbtkpJQ3HBOiDOoshZomCSEhBduTN
KYSXVNS4Ta+shE3G0NRYh0x51xG9I5M79rgebqZrUMm/iHayJu2z8F/Vuc8c2wZP
JFB/PDxgCLTE8XkSm/o56mrS7flWBgcS5odSF7vC21dd/M5B03/DArt9XEk+0bhA
pHDgeS0LYyZrFLg4f8CpQoyTJS4ar4urZJRyhLJbcognr7FA9q7RlGdiwlYh6Upq
ioHIHfVT1j2t6KJCUO/zHowkCE5D5mp/pVG+lSReA6GAgtEFRKOpSGA6OTj3csou
YjFm6hIG/qSBi74uW4dKsfWF1jjYHd0CAwEAAaMQMA4wDAYDVR0TBAUwAwEB/zAN
BgkqhkiG9w0BAQUFAAOCAQEAGPIEHpFysO7eBpZDnTMglK0Z4Z4Mq78KXT8d8S+A
8Ds6zuGoT3So0tsI1DiVPodZ8Un3y4rJ4NnO1ueXMwWBvKQVQu7kcBH4d50m/yb5
rZkdg3qIyevIsNFb5AQ2wuM0/LT2KTmYgv09Jy/D58XoKSMtnU9dT57sgwZ0DHE1
RKUUuWceStccPDViBzVGKWgNgNSlzFFIqHYwyohKidh2IFQKw18p+qcAEwcS9KP/
09e1jqpl8FzfxpSfXV+Djouudu9H75mkvvYPoUuZeFeYKrEgFLq9IuDqvflBgL+/
fS8PCgvVMn5tAKMdsV+AOGZ/Shmmo3aLs6nfNyooDsO0Aw==
-----END CERTIFICATE-----
GET /update/2/64/2645f66c4fa03b6ea0a6427c734db1cb.dat HTTP/1.1
Connection: Keep-Alive
Accept: text/*, application/*
User-Agent: AutoUpdate/5.2.0.276 SDDS/2.0 (u="7XXXXXXXXX" c="37c99a16-170e-4aab-94ec-f3bf3abc615b" i="")
Host: dci.sophosupd.com

[2920 bytes missing in capture file].
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDrjCCApagAwIBAgIBFTANBgkqhkiG9w0BAQUFADCBhTEnMCUGA1UEAxMeU29w
aG9zIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSIwIAYJKoZIhvcNAQkBFhNzb3Bo
b3NjYUBzb3Bob3MuY29tMRQwEgYDVQQIEwtPeGZvcmRzaGlyZTELMAkGA1UEBhMC
VUsxEzARBgNVBAoTClNvcGhvcyBQbGMwHhcNMDgxMjAxMDAwMDAwWhcNMjQwMTI4
MDAwMDAwWjCBnDEiMCAGA1UEAxMZU29waG9zSW50ZXJtZWRpYXRlRXhwMjAyNDEi
MCAGCSqGSIb3DQEJARYTc29waG9zY2FAc29waG9zLmNvbTEUMBIGA1UECBMLT3hm
b3Jkc2hpcmUxCzAJBgNVBAYTAlVLMRMwEQYDVQQKEwpTb3Bob3MgTHRkMRowGAYD
VQQLExFTb3Bob3NTZWN1cmVCdWlsZDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBAPP2jxQPAX3fGCjB27ca1tLqgvvwbtkpJQ3HBOiDOoshZomCSEhBduTN
KYSXVNS4Ta+shE3G0NRYh0x51xG9I5M79rgebqZrUMm/iHayJu2z8F/Vuc8c2wZP
JFB/PDxgCLTE8XkSm/o56mrS7flWBgcS5odSF7vC21dd/M5B03/DArt9XEk+0bhA
pHDgeS0LYyZrFLg4f8CpQoyTJS4ar4urZJRyhLJbcognr7FA9q7RlGdiwlYh6Upq
ioHIHfVT1j2t6KJCUO/zHowkCE5D5mp/pVG+lSReA6GAgtEFRKOpSGA6OTj3csou
YjFm6hIG/qSBi74uW4dKsfWF1jjYHd0CAwEAAaMQMA4wDAYDVR0TBAUwAwEB/zAN
BgkqhkiG9w0BAQUFAAOCAQEAGPIEHpFysO7eBpZDnTMglK0Z4Z4Mq78KXT8d8S+A
8Ds6zuGoT3So0tsI1DiVPodZ8Un3y4rJ4NnO1ueXMwWBvKQVQu7kcBH4d50m/yb5
rZkdg3qIyevIsNFb5AQ2wuM0/LT2KTmYgv09Jy/D58XoKSMtnU9dT57sgwZ0DHE1
RKUUuWceStccPDViBzVGKWgNgNSlzFFIqHYwyohKidh2IFQKw18p+qcAEwcS9KP/
09e1jqpl8FzfxpSfXV+Djouudu9H75mkvvYPoUuZeFeYKrEgFLq9IuDqvflBgL+/
fS8PCgvVMn5tAKMdsV+AOGZ/Shmmo3aLs6nfNyooDsO0Aw==
-----END CERTIFICATE-----
GET /update/2/64/2645f66c4fa03b6ea0a6427c734db1cb.dat HTTP/1.1
Connection: Keep-Alive
Accept: text/*, application/*
User-Agent: AutoUpdate/5.2.0.276 SDDS/2.0 (u="7XXXXXXXXX" c="37c99a16-170e-4aab-94ec-f3bf3abc615b" i="")
Host: dci.sophosupd.com

HTTP/1.1 200 OK
Accept-Ranges: bytes
ETag: "8b213c5c2843072d47dda5d7237001ae:1540468002.571153"
Last-Modified: Thu, 25 Oct 2018 11:46:42 GMT
Server: AkamaiNetStorage
Content-Length: 3909
Expires: Tue, 06 Nov 2018 13:32:16 GMT
Date: Tue, 06 Nov 2018 13:31:36 GMT
Connection: keep-alive
Content-Type: application/octet-stream
Cache-Control: s-maxage=40, max-age=40

<?xml version="1.0" encoding="utf-8" ?>
<Warehouse>
<LicenseDescription>Endpoint Protection Advanced</LicenseDescription>
<LastModified>2018-10-25T11:38:28Z</LastModified>
<LastAssigned>2015-08-20T09:44:41Z</LastAssigned>
<FileName>266ac3f214ce22a7ba5847748213816f</FileName>
<URL>http://d1.sophosupd.com/update</URL>
<URL>http://d1.sophosupd.net/update</URL>
<Warehouses>
<WarehouseEntry>
<Name>sdds.def_retired</Name>
</WarehouseEntry>
<WarehouseEntry>
<Name>sdds.fw_linux_s_LIN2018-5.3</Name>
</WarehouseEntry>
<WarehouseEntry>
<Name>sdds.epa_WIN2018-5a.1</Name>
</WarehouseEntry>
<WarehouseEntry>
<Name>sdds.SUM2018-2.1</Name>
</WarehouseEntry>
<WarehouseEntry>
<Name>sdds.MAC2018-4.3</Name>
</WarehouseEntry>
</Warehouses>
<Redirects><Redirect Substitution="d2.sophosupd.net/update-C" Pattern="d2.sophosupd.net/update"/><Redirect Substitution="d2.sophosupd.com/update-C" Pattern="d2.sophosupd.com/update"/><Redirect Substitution="d3.sophosupd.net/update-C" Pattern="d3.sophosupd.net/update"/><Redirect Substitution="d3.sophosupd.com/update-C" Pattern="d3.sophosupd.com/update"/><GET /update/2/64/2645f66c4fa03b6ea0a6427c734db1cb.dat HTTP/1.1
Connection: Keep-Alive
Accept: text/*, application/*
User-Agent: AutoUpdate/5.2.0.276 SDDS/2.0 (u="7XXXXXXXXX" c="37c99a16-170e-4aab-94ec-f3bf3abc615b" i="")
Host: dci.sophosupd.com

[5745 bytes missing in capture file].
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDrjCCApagAwIBAgIBFTANBgkqhkiG9w0BAQUFADCBhTEnMCUGA1UEAxMeU29w
aG9zIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSIwIAYJKoZIhvcNAQkBFhNzb3Bo
b3NjYUBzb3Bob3MuY29tMRQwEgYDVQQIEwtPeGZvcmRzaGlyZTELMAkGA1UEBhMC
VUsxEzARBgNVBAoTClNvcGhvcyBQbGMwHhcNMDgxMjAxMDAwMDAwWhcNMjQwMTI4
MDAwMDAwWjCBnDEiMCAGA1UEAxMZU29waG9zSW50ZXJtZWRpYXRlRXhwMjAyNDEi
MCAGCSqGSIb3DQEJARYTc29waG9zY2FAc29waG9zLmNvbTEUMBIGA1UECBMLT3hm
b3Jkc2hpcmUxCzAJBgNVBAYTAlVLMRMwEQYDVQQKEwpTb3Bob3MgTHRkMRowGAYD
VQQLExFTb3Bob3NTZWN1cmVCdWlsZDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBAPP2jxQPAX3fGCjB27ca1tLqgvvwbtkpJQ3HBOiDOoshZomCSEhBduTN
KYSXVNS4Ta+shE3G0NRYh0x51xG9I5M79rgebqZrUMm/iHayJu2z8F/Vuc8c2wZP
JFB/PDxgCLTE8XkSm/o56mrS7flWBgcS5odSF7vC21dd/M5B03/DArt9XEk+0bhA
pHDgeS0LYyZrFLg4f8CpQoyTJS4ar4urZJRyhLJbcognr7FA9q7RlGdiwlYh6Upq
ioHIHfVT1j2t6KJCUO/zHowkCE5D5mp/pVG+lSReA6GAgtEFRKOpSGA6OTj3csou
YjFm6hIG/qSBi74uW4dKsfWF1jjYHd0CAwEAAaMQMA4wDAYDVR0TBAUwAwEB/zAN
BgkqhkiG9w0BAQUFAAOCAQEAGPIEHpFysO7eBpZDnTMglK0Z4Z4Mq78KXT8d8S+A
8Ds6zuGoT3So0tsI1DiVPodZ8Un3y4rJ4NnO1ueXMwWBvKQVQu7kcBH4d50m/yb5
rZkdg3qIyevIsNFb5AQ2wuM0/LT2KTmYgv09Jy/D58XoKSMtnU9dT57sgwZ0DHE1
RKUUuWceStccPDViBzVGKWgNgNSlzFFIqHYwyohKidh2IFQKw18p+qcAEwcS9KP/
09e1jqpl8FzfxpSfXV+Djouudu9H75mkvvYPoUuZeFeYKrEgFLq9IuDqvflBgL+/
fS8PCgvVMn5tAKMdsV+AOGZ/Shmmo3aLs6nfNyooDsO0Aw==
-----END CERTIFICATE-----

I have overwritten the Username with 7XXXXXXXXX , and pasted into a Txt doc.

0 QC over 6 years ago in reply to Tania Keenan1

Hello Tania Keenan1,

thanks.
This is traffic to/from dci.sophosupd.com, meta information and catalogs. This isn't all of the traffic up to the download error though - is it? As I don't see the request for the failing .dat (and Host: isn't one of the dn.sophosupd). I'd expect the possibly incorrect headers near the end of the capture.

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 Tania Keenan1 over 6 years ago in reply to QC

Thats all the data that there was using the filter you suggested.

However,,, I have just run the capture again and the update went through with no issues.....

I have manually updated 2 other Pros as well and they are now also updating successfully .
Cancel
Vote Up 0 Vote Down

Cancel