When Symantec Messaging Gateway (SMG) releases prior to SMG 10.6.1 is configured to use the Rapid Response (also known as Rapid Release) Antivirus definitions via Malware -> LiveUpdate -> Enable Rapid Response updates rather than the default Antivirus definitions, Messaging Gateway consumes significantly more bandwidth than expected.
When configured to use Rapid Response definitions, the AV definitions are downloaded with each check rather than only downloaded when the Rapid Response ruleset (sequence) has been updated. This significantly increases the bandwidth used by Messaging Gateway.
This issue was corrected in Messaging Gateway 10.6.1. This 10.6.1 release contains critical updates to resolve reported memory and logging issues, and enhance Rapid Release update to reduce bandwidth usage. New RR definition packages are now only downloaded if a change (new sequence of RR definitions) is detected.
Please always upgrade to the latest-available release to take advantage of all fixes, enhancements and improvements.
Note that Rapid Release definitions are published more frequently than certified Antivirus definitions, so there will be more definition sets downloaded and applied throughout the day. Though this will consume additional bandwidth, it is strongly recommended to use Rapid Release on the organization's perimeter (Messaging Gateway) for protection against the very latest mail-bourne threats in circulation.