Apple Software Update client queries the following URLs for update catalogs by default:
The .sucatalog format is the same for 10.4, 10.5 and the Windows Apple Software Update client.
Note swscan.apple.com/content/catalogs seems to have the same content as swcatalog.apple.com/content/catalogs. swcatalog is akamai hosted, swcan is not (and is MUCH slower).
For each available update the .sucatalog file lists a URL to a .dist (Installer distribution script) and a URL to an install package (or a few packages) to be installed if the .dist script says it is needed.
The URLs all point to various files within http://swcdn.apple.com/content/downloads/ at present. swcdn is akamai hosted.
Each .dist script can call javascript commands in a special Installer framework sandbox to work out if they should be installed or not.
The .dist files used to work out if an update applies are neither signed nor checksummed.
The actual install package/exe is signed:
Mac clients can be pointed to a catalog file other than the default via:
defaults write /Library/Preferences/com.apple.SoftwareUpdate CatalogURL -string "http://appleupdate.centenary.usyd.edu.au:8088/index.sucatalog"
if the address given ends in '/' the update client can automatically append the index.sucatalog. The client is quite happy being pointed to a server running on tcp/80 rather than tcp/8088.
Alternatively, if you control your network -- you can use a web proxy server redirect, or a DNS static entry pointed locally for swscan.apple.com and swcatalog.apple.com (taking care that your mirror server can still get out to the real server).
The benefit of this mechanism is that no client change is required, this is perhaps desirable if personally owned student laptops hang out on your laptop and you don't want to change every client. (if any of your Internet charge is per GB this is a happy thing to do!)
You only need to catch the request for the .sucatalog files, nothing will be downloaded from swcdn.apple.com unless pointed that way by the .sucatalog file.
The Apple Software Update server is merely an instance of Apache serving up a mirror of what is available at swscan.apple.com / swcatalog.apple.com / swcdn.apple.com. In default configuration it runs on port tcp/8088. To sync the updates with the Apple servers a separate process -- /usr/sbin/swupd_syncd is run.
The operation of swupd_syncd differs between 10.4 and 10.5 server:
If you do not want any control of what updates are enabled a script that simply grabs the .sucatalog files and mirrors the contents is a robust replacement to the Apple offering. (and can be run off a beefy linux/unix mirroring server if you are a big uni and have such a thing)
It is a tiny bit more work if you want control over which updates are becoming enabled. (work I haven't done because I don't really want nor need that)