No, I know it's using Port 80 (HTML) but what I want to know is where it's going to get the download because that website is blocked by our "new" misbegotten firewall program and if I know where it's going I get get it put on the allowable list. I suspect that there must be a program that "sniffs" around and tells you what's processes are going on during one of those update downloads!
Your "new misbegotten" firewall should keep a log of refused connections...no? If port 80 is open, then it should work unless specific domains are excluded. You may need to investigate more than one log file and more than one config file.
let's see...there's the router firewall, then the third party firewall, then the Mac OS firewall. Any more running?