Which protocol is used when the BigFix Client contacts its Relay to gather new content?

The BigFix Client contacts its Relay to gather new content using the UDP protocol on port 52311 (by default).

The UDP protocol is used for notifications, which are messages sent by the Relay to inform the Client that there is new content available, such as actions, fixlets, tasks, or analyses.

The Client then initiates a TCP connection with the Relay on the same port to download the new content and report the results back to the Relay.

The TCP protocol is used for data transfers, which are more reliable and secure than UDP, but also more resource-intensive and slower.

The Relay then forwards the Client reports to the Root Server or another Relay using the TCP protocol as well. References:

Port requirements for communication between root to clients via relay

BigFix Wiki - BigFix Relays

How is BigFix secure? Authentication or Protocol used in BigFix for secure communication