A Symantec Endpoint Protection (SEP) agent is unable to complete the registration process with its Manager (SEPM). It is possible to see it in the expected group but its status is offline.
Replacing the sylink.xml file, resetting the hardware ID or reinstalling the SEP agent do not help.
The SEPM and other SEP clients do not have any problem.
Packets capture shows that the SEP agent is properly sending the registration request and getting the confirmation of the same from the SEPM.
In the SEP client, under Help > Troubleshooting > Connection Status, this message is displayed:
Not connected.Error details:
This is a general error message indicating that communication with the server failed. Run the Symantec Endpoint Protection Support Tool (SST) to diagnose the problem.
SST report shows:
Connection status: Not connected.
Other:Error in registration response (8).
In the sylink.log, the registration fails due to ERR to query content length; differently from similar issues, there is a 200 OK confirmation here:
12/11 13:59:06.765  13:59:6=>Send HTTP REQUEST
12/11 13:59:06.859  13:59:6=>HTTP REQUEST sent
12/11 13:59:06.859  13:59:6=>QUERY return code
12/11 13:59:06.859  13:59:6=>QUERY return code completed
12/11 13:59:06.859  <SendRegistrationRequest:>SMS return=200
12/11 13:59:06.859  <ParseHTTPStatusCode:>200=>200 OK
12/11 13:59:06.859  <SendRegistrationRequest:>ERR to query content length
12/11 13:59:06.859  <SendRegistrationRequest:>Content Lenght =>
12/11 13:59:06.859  HTTP returns status code=200
12/11 13:59:06.859  <SendRegistrationRequest:>RECEIVE STAGE COMPLETED
12/11 13:59:06.859  <SendRegistrationRequest:>COMPLETED, returned 1
No errors in AgentRegister-0.log from the SEPM (only with finest debugging).
In the packets capture, several DUP ACK are logged.
Old NIC's drivers have been identified on both involved systems, version 18.104.22.168 on the SEPM and 22.214.171.124 Rev A on the system with the SEP client, they are from 2008.
Upgrading NIC's drivers on the problematic system.
Windows 2003 32 bit with a DUAL card of Intel PRO 1000 NICs