In Push Mode : The client establishes a
constant HTTPconnection to the management server. Whenever a change occurs in the management server status, it notifies the client immediately
On the other hand In Pull Mode The client connects to the manager periodically depending on the frequency of the heartbeat setting. The client checks the status of the management server when the client connects.
In either mode, the client takes the corresponding action that is based on the
change in the status of the management server. Because it requires a constant
connection, push mode requires a large network bandwidth. Most of the time you should set up clients in pull mode.
A heartbeat is the frequency at which client computers upload data such as log
entries and download policies. A heartbeat is a protocol that each client uses to
communicate with the Symantec Endpoint Protection Manager. The first heartbeat occurs immediately after the client starts. The next heartbeat occurs at the heartbeat frequency that you set.
The heartbeat frequency is a key factor in the number of clients that each Symantec Endpoint Protection Manager can support.