Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 1 of 430 PageID #: 33732
`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 1 of 430 PagelD #: 33732
`
`
`
`
`
`EXHIBIT 1
`EXHIBIT 1
`
`
`
`
`
`
`
`
`
`
`
`
`
`

`

`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 2 of 430 PageID #: 33733
`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 2 of 430 PagelD #: 33733
`
`THIS EXHIBIT HAS BEEN
`THIS EXHIBIT HAS BEEN
`REDACTED ,IN ITS ENTIRETY
`REDACTEDIN ITS ENTIRETY
`
`

`

`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 3 of 430 PageID #: 33734
`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 3 of 430 PagelD #: 33734
`
`
`
`
`
`EXHIBIT 2
`EXHIBIT 2
`
`
`
`
`
`
`
`
`
`
`
`
`
`

`

`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 4 of 430 PageID #: 33735
`
`IN THE UNITED STATES DISTRICT COURT
`FOR THE DISTRICT OF DELAWARE
`
`
`
`
`
`C.A. No. 16-455 (RGA)
`
`
`)))))))))))
`
`ACCELERATION BAY LLC,
`
`
`
`
`
`TAKE-TWO INTERACTIVE SOFTWARE,
`INC., ROCKSTAR GAMES, INC., and 2K
`SPORTS, INC., Delaware Corporations,
`
`
`
`
`
`
`
`
`
`Plaintiff,
`
`
`
`v.
`
`
`
`Defendants.
`
`
`
`EXPERT REPORT OF PATRICK CONLIN REGARDING TESTING
`OF TAKE-TWO INTERACTIVE SOFTWARE ACCUSED PRODUCTS
`
`
`
`
`
`
`
`
`

`

`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 5 of 430 PageID #: 33736
`
`TABLE OF CONTENTS
`Summary of Opinions ..........................................................................................................1 
`
`Experience and Qualifications .............................................................................................1 
`
`a) 
`
`b) 
`
`c) 
`
`Curriculum Vitae .....................................................................................................1 
`
`Prior Testimony .......................................................................................................2 
`
`Compensation ..........................................................................................................2 
`
`Materials Considered ...........................................................................................................2 
`
`Demonstratives ....................................................................................................................3 
`
`Testing Methodology ...........................................................................................................3 
`
`Assumptions and Testing Background ................................................................................4 
`
`Testing of Grand Theft Auto V Online ................................................................................6 
`
`1. 
`
`2. 
`
`3. 
`
`4. 
`
`5. 
`
`6. 
`
`7. 
`
`
`
`i
`
`

`

`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 6 of 430 PageID #: 33737
`
`I, Patrick G. Conlin, have been asked by Plaintiff Acceleration Bay, LLC (“Acceleration
`
`Bay”) to conduct testing of certain accused products and to testify as an expert witness in the
`
`above referenced action. I expect to testify at trial in this action regarding the opinions set forth
`
`in this report (the “Report”), as well as on any other issues for which I have submitted or will
`
`submit an expert report in this action.
`
`1.
`
`Summary of Opinions
`
`1.
`
`Based on tests that I conducted, it is my opinion that Grand Theft Auto V Online
`
`(“GTA”):
`
` uses direct peer-to-peer connections to exchange data between player consoles;
`
`
`
`includes players outside the United States in gameplay sessions based in the
`United States;
`
` uses a handshake protocol to establish direct peer-to-peer connections between
`player consoles;
`
` uses a handshake protocol which includes a unique ID for every player in the
`session;
`
`
`
`limits the direct exchange of data between players based on their proximity in the
`game world; and
`
` uses both direct peer-to-peer connections and relay connections to exchange data
`between player consoles.
`
`2.
`
`Experience and Qualifications
`
`a) Curriculum Vitae
`
`2.
`
`The details of my education, work experience, and publications (including any
`
`publications authored in the last 10 years) are summarized in my curriculum vitae (“CV”)
`
`attached hereto as Appendix A of this Report.
`
`1
`
`

`

`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 7 of 430 PageID #: 33738
`
`3.
`
`In addition to my professional experience and training set forth in my CV, I have
`
`decades of experience playing games of all types on various devices and operating systems,
`
`including DOS, Windows, MacOS, iOS, Android, Xbox, PlayStation, Nintendo and Sega.
`
`b) Prior Testimony
`
`4.
`
`A list of any cases in which I have testified at deposition or trial or in written
`
`reports during at least the past five years is included in Appendix A of this Report.
`
`c) Compensation
`
`5.
`
`My rate of compensation for my work in this case is $200 per hour plus any direct
`
`expenses incurred. My compensation is based solely on the amount of time that I devote to
`
`activity related to this case and is in no way affected by any opinions that I render. I receive no
`
`other compensation from work on this action. My compensation is not dependent on the
`
`outcome of this matter.
`
`3.
`
`Materials Considered
`
`6.
`
`I ran tests on the online modes of Grand Theft Auto V (“GTA”) as discussed
`
`herein. In conducting the tests, I relied on the instructions for GTA to configure the network
`
`settings. I also relied on the reference materials identified herein by citation. A list of additional
`
`materials considered is included as Appendix B of this Report.
`
`7.
`
`I had a conversation with the infringement experts in this case, Drs. Nenad
`
`Medvidović and Michael Mitzenmacher, during which I explained to them the tests that I
`
`conducted that are discussed in this Report, including my methodology and the results of the
`
`tests.
`
`2
`
`

`

`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 8 of 430 PageID #: 33739
`
`4.
`
`Demonstratives
`
`8.
`
`I anticipate that I may create or cause to be created demonstratives that I will use
`
`at trial to help explain various issues to the Court and jury, such as the nature of the tests I
`
`conducted described herein and the results of those tests. These demonstrative exhibits will
`
`include non-graphical illustrations (such as documents, charts, tables, etc.) and graphical
`
`illustrations (such as figures, drawings, pictures, videos, etc.). While these demonstratives have
`
`not yet been created, they will be completed and demonstrated at trial.
`
`9.
`
`To further aid the Court and jury in understanding my opinion, I anticipate that I
`
`will demonstrate my testing discussed herein at trial, including either a live or prerecorded
`
`demonstration of my testing. A live demonstration may include having physical products in
`
`Court and/or access to the products via an Internet connection. I may create a video, or series of
`
`videos, demonstrating my testing of the accused products. I may also create a series of slides.
`
`These videos or slides may include voice overs, highlighting and call outs.
`
`5.
`
`Testing Methodology
`
`10.
`
`I used the following test setup and methodology for the “Direct Peer-to-Peer
`
`Connections”, “Use of Handshake Protocol” and “Usage of Relay Servers” Grand Theft Auto V
`
`scenarios:
`
`● A Netgear hub with three connections:
`○ Xbox One
`○ a packet capture device: a GIGABYTE BRIX GB-BSi7HAL-6500 running
`Kali Linux 4.9.0-kali3-amd64 and Wireshark 2.2.5
`○ A WatchGuard XTM26-W firewall
`● I configured the Xbox One with a static IP address on the local network.
`● I configured the WatchGuard device to forward all traffic according to the
`
`3
`
`

`

`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 9 of 430 PageID #: 33740
`
`documentation provided by the game publisher.1
`● I configured the WatchGuard device to route all traffic from the Xbox One
`through a unique public, static IP address, dedicated solely to traffic from the
`Xbox One.
`● I connected the WatchGuard device to the Internet.
`● I initiated a Wireshark capture session to capture network traffic to and from the
`Xbox One during the given test scenario.
`● I initiated a gameplay session initiated.
`● I analyzed the resulting capture sessions using Wireshark.
`
`
`11.
`
`In addition to the above, the testing methodology for the “Observation of
`
`proximity-based data connections” GTA scenario included the following:
`
`● A second setup identical to the setup above, with the exception that the local
`subnet and public IP address were unique to the second setup.
`● A video capture for each gameplay session, synchronized with the associated
`network capture, and synchronized between the two Xbox Ones.
`
`
`12.
`
`For each game scenario referenced above, several sessions and captures were
`
`performed and extensive analysis was performed on the resulting captures to characterize the
`
`communications.
`
`6.
`
`Assumptions and Testing Background
`
`13.
`
`I made the following assumptions in conducting my tests:
`
` Devices communicating on the ports designated in game documentation are
`transmitting game data.
`
` Other Xbox One devices participating in multi-player sessions are not located on
`Amazon AWS or other commercial infrastructure networks, Co-location or
`Content Distribution Network facilities.
`
` Game server infrastructure is not located on ISP residential customer networks.
`
`
`1 AB-TT 002818-24 (Grand Theft Auto V: https://support.rockstargames.com/hc/en-
`us/articles/200525767-GTA-Online-Connection-Troubleshooting).
`
`4
`
`

`

`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 10 of 430 PageID #: 33741
`
`14.
`
`In both the Transmission Control Protocol (“TCP”) and User Datagram Protocol
`
`(“UDP”) contexts network devices communicating over the internet via the Internet Protocol
`
`(“IP”) label their traffic with valid, routable source and destination addresses such as
`
`166.170.58.233.2 Three administrative systems that support the functionality of TCP/IP and
`
`UDP/IP communications provide information about the source and/or destination of network
`
`traffic: reverse DNS lookups (“rDNS”), Geo-location (“Geo-IP”), and the Autonomous System
`
`Number (“ASN”).
`
`15. Where possible, I associated rDNS, Geo-IP, and ASN data with the captured
`
`network traffic to determine the location of the participant.
`
`16.
`
`IP addresses are assigned to legal entities by various regional registries
`
`coordinated by the Internet Assigned Numbers Authority.3 If the block of addresses is large
`
`enough, the entity is given an ASN and is responsible for telling the rest of the internet how to
`
`route traffic to those IP addresses. The typical entity of this size is an ISP, but other
`
`organizations such as Microsoft, Amazon.com, Google Inc., and Electronic Arts, Inc. also have
`
`ASNs. Any “publicly routable” IP address can be associated with its registered ASN. It is
`
`reasonable to conclude that the ASN associated with an IP address indicates the network to
`
`which that IP address is connected.
`
`17.
`
`The DNS protocol is used to map Fully Qualified Domain Names (“FQDN”) such
`
`as www.google.com to IP addresses such as 74.125.23.105.4 rDNS is used to map IP addresses
`
`back to FQDNs. Organizations such as ISPs use DNS and rDNS to aid in the management of
`
`their IP addresses and devices by associating IP addresses with informative FQDN entries that
`
`
`2 AB-TT 007677-81 (https://en.wikipedia.org/wiki/Internet_Protocol).
`3 AB-TT 007682-83 (https://www.iana.org/numbers).
`4 AB-TT 007657-73 (https://en.wikipedia.org/wiki/Domain_Name_System).
`
`5
`
`

`

`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 11 of 430 PageID #: 33742
`
`may contain indicators of physical or logical (network) location. For example, Comcast uses the
`
`FQDN for the IP address 67.176.165.137 (c-67-176-165-137.hsd1.il.comcast.net) to indicate the
`
`IP address itself, the type of network (hsd1: High Speed Data, a/k/a cable broadband), and the
`
`state (il: Illinois). Similarly the Comcast IP address 73.235.214.39 on their cable broadband
`
`network in California has the FQDN c-73-235-214-39.hsd1.ca.comcast.net.
`
`18.
`
`Geolocation information is maintained by various entities and can be used to
`
`associate a given IP address with a physical location.5 The degree of accuracy and precision
`
`varies from IP address to IP address and from source to source. I used the MaxMind GeoLite2
`
`City database which is considered reasonably accurate and precise.6
`
`19.
`
`Combining the assumptions stated above and ASN, FQDN, and GeoIP data, I
`
`obtained an indication of whether a given endpoint is part of a game’s server infrastructure or
`
`whether the endpoint is another Xbox One.
`
`7.
`
`Testing of Grand Theft Auto V Online
`
`20.
`
`Direct Peer-to-Peer Connections: Over a series of sessions in various missions
`
`and open world play, I observed direct peer-to-peer connections over the Internet with other
`
`players in the gameplay sessions, including players from outside the United States. The data I
`
`collected are attached as Appendix C to this Report.
`
`21.
`
`According to Rockstar Games’ website GTA5 primarily uses UDP Port 3074 for
`
`in-game communications.7
`
`22.
`
`The following table contains a representative sample of endpoints observed
`
`during these sessions that communicated with my Xbox One during gameplay. I shaded in
`
`
`5 AB-TT 007674-76 (https://en.wikipedia.org/wiki/Geolocation).
`6 AB-TT 007655-56 (http://dev.maxmind.com/geoip/geoip2/geolite2/).
`7 AB-TT 002631-35 (https://support.rockstargames.com/hc/en-us/articles/200525767).
`
`6
`
`

`

`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 12 of 430 PageID #: 33743
`
`yellow endpoints that I believe are Xbox One consoles, based on the analysis outlined above.
`
`Geo IP Country Geo IP City
`
`United States
`
`Rockford, IL
`
`ASN
`AS7922 Comcast Cable
`Communications, LLC
`
`AS20115 Charter
`Communications
`
`AS7018 AT&T Services,
`Inc.
`AS11427 Time Warner
`Cable Internet LLC
`
`AS21864 TDS TELECOM
`AS7922 Comcast Cable
`Communications, LLC
`AS22773 Cox
`Communications Inc.
`
`AS19108 Suddenlink
`Communications
`AS7922 Comcast Cable
`Communications, LLC
`
`AS11888 Television
`Internacional, S.A. de C.V.
`AS5650 Frontier
`Communications of
`America, Inc.
`
`AS7018 AT&T Services,
`Inc.
`AS5650 Frontier
`Communications of
`America, Inc.
`AS7922 Comcast Cable
`Communications, LLC
`AS5650 Frontier
`Communications of
`America, Inc.
`AS11888 Television
`Internacional, S.A. de C.V.
`AS7922 Comcast Cable
`Communications, LLC
`
`IP/FQDN
`c-98-226-154-
`185.hsd1.il.comcast.net
`68-184-3-
`197.dhcp.stls.mo.charter.c
`om
`108-204-196-
`231.lightspeed.mmphtn.sb
`cglobal.net
`cpe-72-190-208-
`109.satx.res.rr.com
`226.131.100.208.bendbroa
`dband.com
`c-73-247-89-
`231.hsd1.il.comcast.net
`ip98-178-179-
`131.tu.ok.cox.net
`173-218-23-81-
`grvl.mid.dyn.suddenlink.n
`et
`c-98-214-181-
`160.hsd1.il.comcast.net
`CableLink64-
`110.telefonia.InterCable.n
`et
`
`47.186.202.215
`162-201-218-
`67.lightspeed.cicril.sbcglo
`bal.net
`
`United States
`
`United States
`
`Memphis, TN
`
`United States
`
`Seguin, TX
`
`United States
`
`Bend, OR
`
`United States
`
`Rockford, IL
`
`United States
`
`Sand Springs, OK
`
`United States
`
`Dardanelle, AR
`
`United States
`
`Washington, IL
`
`Mexico
`
`Monterrey, 19
`
`United States
`
`Denton, TX
`
`United States
`
`Chicago, IL
`
`47.184.98.23
`c-75-64-117-
`255.hsd1.tn.comcast.net United States
`
`United States
`
`Denton, TX
`
`Memphis, TN
`
`United States
`
`47.184.83.61
`CableLink-201-162-56-
`227.Hosts.InterCable.net Mexico
`c-73-220-9-
`166.hsd1.ca.comcast.net United States
`
`Denton, TX
`San Nicolás De Los
`Garza, 19
`
`Orland, CA
`
`7
`
`

`

`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 13 of 430 PageID #: 33744
`
`United States
`
`ip68-105-119-
`105.sd.sd.cox.net
`cpe-24-162-166-
`100.rgv.res.rr.com
`c-73-217-205-
`59.hsd1.mo.comcast.net United States
`
`United States
`
`Encinitas, CA
`
`Brownsville, TX
`
`Greenwood, MO
`
`69.55.36.82
`71-89-228-
`212.dhcp.reno.nv.charter.c
`om
`104-183-22-
`244.lightspeed.rcsntx.sbcg
`lobal.net
`64.146.199.49
`
`United States
`
`Watford City, ND
`
`United States
`
`Dayton, NV
`
`United States
`United States
`
`Grand Prairie, TX
`Aumsville, OR
`
`40.90.10.52
`
`United States
`
`Cheyenne, WY
`
`192.81.245.123
`https-68-142-107-
`164.lax.llnw.net
`108-196-101-
`186.lightspeed.sntcca.sbcg
`lobal.net
`
`United States
`
`New York, NY
`
`United States
`
`Tempe, AZ
`
`United States
`
`Santa Rosa, CA
`
`192.81.245.112
`
`United States
`
`New York, NY
`
`192.81.241.100
`
`United States
`
`New York, NY
`
`172.56.7.129
`
`United States
`
`Dallas, TX
`
`75-170-58-
`184.eugn.qwest.net
`
`131.253.29.133
`host-76-11-211-
`139.newwavecomm.net
`customer-GDL-228-
`194.megared.net.mx
`profile.xboxlive.com.akad
`ns.net
`
`United States
`
`Eugene, OR
`
`United States
`
`United States
`
`Carmi, IL
`
`Mexico
`
`Guadalajara, 13
`
`United States
`
`8
`
`AS22773 Cox
`Communications Inc.
`AS11427 Time Warner
`Cable Internet LLC
`AS7922 Comcast Cable
`Communications, LLC
`AS18780 Reservation
`Telephone Coop.
`
`AS20115 Charter
`Communications
`
`AS7018 AT&T Services,
`Inc.
`AS11404 vanoppen.biz LLC
`AS8075 Microsoft
`Corporation
`AS46555 TAKE-TWO
`INTERACTIVE
`SOFTWARE, INC.
`AS22822 Limelight
`Networks, Inc.
`
`AS7018 AT&T Services,
`Inc.
`AS46555 TAKE-TWO
`INTERACTIVE
`SOFTWARE, INC.
`AS46555 TAKE-TWO
`INTERACTIVE
`SOFTWARE, INC.
`AS21928 T-Mobile USA,
`Inc.
`AS209 Qwest
`Communications Company,
`LLC
`AS8075 Microsoft
`Corporation
`AS18812 New Wave
`Communications
`AS13999 Mega Cable, S.A.
`de C.V.
`AS8075 Microsoft
`Corporation
`
`

`

`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 14 of 430 PageID #: 33745
`
`xblwus.ipv6.microsoft.co
`m.akadns.net
`cy2.vortex.data.microsoft.
`com.akadns.net
`
`fixed-187-190-163-
`181.totalplay.com.mx
`99-121-123-
`5.lightspeed.glptms.sbcglo
`bal.net
`
`United States
`
`San Jose, CA
`
`United States
`
`Cheyenne, WY
`
`Mexico
`
`Toluca, 15
`
`United States
`
`Moss Point, MS
`
`40.90.10.180
`
`United States
`
`Cheyenne, WY
`
`United States
`
`United States
`
`United States
`
`8.40.254.224
`c-67-176-165-
`137.hsd1.il.comcast.net
`c-24-22-199-
`127.hsd1.wa.comcast.net United States
`msnbot-65-52-108-
`233.search.msn.com
`cpe-172-113-127-
`118.socal.res.rr.com
`cpe-104-175-157-
`173.socal.res.rr.com
`
`United States
`
`United States
`
`Purcell, OK
`
`Morris, IL
`
`Everett, WA
`
`Boydton, VA
`
`Moreno Valley, CA
`
`AS8075 Microsoft
`Corporation
`AS8075 Microsoft
`Corporation
`AS17072 TOTAL PLAY
`TELECOMUNICACIONES
`SA DE CV
`
`AS7018 AT&T Services,
`Inc.
`AS8075 Microsoft
`Corporation
`AS22898 ATLINK
`SERVICES, LLC
`AS7922 Comcast Cable
`Communications, LLC
`AS7922 Comcast Cable
`Communications, LLC
`AS8075 Microsoft
`Corporation
`AS20001 Time Warner
`Cable Internet LLC
`AS20001 Time Warner
`Cable Internet LLC
`AS8075 Microsoft
`Corporation
`
`157.56.149.60
`200.56.109.172.dsl.dyn.tel
`nor.net
`187-167-219-
`78.static.axtel.net
`108-206-195-
`144.lightspeed.cicril.sbcgl
`obal.net
`201.170.54.50.dsl.dyn.teln
`or.net
`201-157-91-
`35.internetmax.maxcom.n
`et.mx
`vpc-elb-rpdxtmweb-
`1283008362.us-west-
`2.elb.amazonaws.com
`c-73-235-214-
`39.hsd1.ca.comcast.net
`96-3-99-228-
`dynamic.midco.net
`
`United States
`
`Chicago, IL
`
`Mexico
`
`Mexico
`
`Tijuana, 02
`
`Monterrey, 19
`
`AS8151 Uninet S.A. de C.V.
`AS6503 Axtel, S.A.B. de
`C.V.
`
`United States
`
`Chicago, IL
`
`Mexico
`
`Tijuana, 02
`
`Mexico
`
`Mexico, 09
`
`AS7018 AT&T Services,
`Inc.
`
`AS8151 Uninet S.A. de C.V.
`AS22566 Maxcom
`Telecomunicaciones, S.A.B.
`de C.V.
`
`United States
`
`Boardman, OR
`
`United States
`
`Elk Grove, CA
`
`United States
`
`Bismarck, ND
`
`AS16509 Amazon.com, Inc.
`AS7922 Comcast Cable
`Communications, LLC
`AS11232 Midcontinent
`Communications
`
`9
`
`

`

`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 15 of 430 PageID #: 33746
`
`134.170.178.9
`
`United States
`
`68-171-177-25.wtcks.net United States
`cpe-45-51-220-
`15.socal.res.rr.com
`
`United States
`
`Wamego, KS
`
`San Bernardino, CA
`
`174-28-60-
`156.albq.qwest.net
`
`United States
`
`Rio Rancho, NM
`
`149.12.1.145
`
`United Kingdom Aylesbury, B9
`
`109.77.207.82
`
`Ireland
`
`Edgeworthstown, 18
`
`177.237.75.135.cable.dyn.
`cableonline.com.mx
`138-229-152-
`117.dhcp.rvsd.ca.charter.c
`om
`173-217-87-21-
`lkch.mid.dyn.suddenlink.n
`et
`
`Mexico
`
`Cancún, 23
`
`United States
`
`California City, CA
`
`United States
`
`Sulphur, LA
`
`AS8075 Microsoft
`Corporation
`AS19504 WTC
`Communications, Inc.
`AS20001 Time Warner
`Cable Internet LLC
`AS209 Qwest
`Communications Company,
`LLC
`AS48945 Independent Fibre
`Networks Limited
`AS15502 Vodafone Ireland
`Limited
`AS28512 Cablemas
`Telecomunicaciones SA de
`CV
`
`AS20115 Charter
`Communications
`
`AS19108 Suddenlink
`Communications
`AS5650 Frontier
`Communications of
`America, Inc.
`AS7922 Comcast Cable
`Communications, LLC
`AS852 TELUS
`Communications Inc.
`AS7922 Comcast Cable
`Communications, LLC
`AS8075 Microsoft
`Corporation
`AS852 TELUS
`Communications Inc.
`AS11427 Time Warner
`Cable Internet LLC
`
`AS19108 Suddenlink
`Communications
`AS20001 Time Warner
`Cable Internet LLC
`AS20001 Time Warner
`Cable Internet LLC
`AS20001 Time Warner
`Cable Internet LLC
`
`United States
`
`United States
`
`47.188.188.76
`c-73-153-81-
`52.hsd1.co.comcast.net
`d50-92-1-
`232.bchsia.telus.net
`c-76-107-197-
`201.hsd1.tn.comcast.net United States
`
`Canada
`
`Irving, TX
`
`Englewood, CO
`
`Cordova, TN
`
`65.55.158.118
`d66-183-193-
`134.bchsia.telus.net
`cpe-24-243-101-
`171.rgv.res.rr.com
`173-216-13-210-
`cabt.mid.dyn.suddenlink.n
`et
`cpe-23-241-203-
`33.socal.res.rr.com
`cpe-107-185-191-
`165.socal.res.rr.com
`cpe-172-251-201-
`15.socal.res.rr.com
`
`United States
`
`San Jose, CA
`
`Canada
`
`Surrey, BC
`
`United States
`
`Mcallen, TX
`
`United States
`
`Cabot, AR
`
`United States
`
`United States
`
`Hemet, CA
`
`United States
`
`Hemet, CA
`
`10
`
`

`

`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 16 of 430 PageID #: 33747
`
`24-217-157-
`124.dhcp.stls.mo.charter.c
`om
`68-112-202-
`126.dhcp.eucl.wi.charter.c
`om
`
`United States
`
`O Fallon, MO
`
`United States
`
`Sun Prairie, WI
`
`static24-72-9-
`246.r.rev.accesscomm.ca Canada
`207-118-138-
`185.dyn.centurytel.net
`
`United States
`
`Regina, SK
`
`Denmark, WI
`
`San Marcos, CA
`
`AS20115 Charter
`Communications
`
`AS20115 Charter
`Communications
`AS21804 Access
`Communications Co-
`operative Limited
`AS22561 CenturyTel
`Internet Holdings, Inc.
`AS22773 Cox
`Communications Inc.
`
`AS577 Bell Canada
`
`Canada
`
`United States
`
`United States
`
`United States
`
`ip68-7-4-19.sd.sd.cox.net United States
`bas1-markham24-70-26-
`174-218.dsl.bell.ca
`99-125-122-
`142.lightspeed.rcsntx.sbcg
`lobal.net
`104-51-118-
`137.lightspeed.mssnks.sbc
`global.net
`c-50-129-146-
`188.hsd1.il.comcast.net
`dsl-187-145-62-251-
`dyn.prod-
`infinitum.com.mx
`187.250.60.244.dsl.dyn.tel
`nor.net
`97-87-190-
`195.dhcp.stls.mo.charter.c
`om
`56.4.135.77.rev.sfr.net
`24-196-34-
`5.dhcp.fdul.wi.charter.com United States
`
`Mexico
`
`Mexico
`
`United States
`France
`
`Frisco, TX
`
`Lees Summit, MO
`
`Carpentersville, IL
`
`AS7018 AT&T Services,
`Inc.
`
`AS7018 AT&T Services,
`Inc.
`AS7922 Comcast Cable
`Communications, LLC
`
`Querétaro, 22
`
`AS8151 Uninet S.A. de C.V.
`
`Tijuana, 02
`
`AS8151 Uninet S.A. de C.V.
`
`Lake Saint Louis,
`MO
`Solliès-toucas, B8
`
`Lakeville, MN
`
`AS20115 Charter
`Communications
`AS15557 SFR
`AS20115 Charter
`Communications
`AS6453 TATA
`COMMUNICATIONS
`(AMERICA) INC
`AS46555 TAKE-TWO
`INTERACTIVE
`SOFTWARE, INC.
`
`AS20115 Charter
`Communications
`AS3356 Level 3
`Communications, Inc.
`
`63.243.244.10
`
`United States
`
`Cambridge, MA
`
`192.81.245.125
`75-132-90-
`224.dhcp.stls.mo.charter.c
`om
`
`United States
`
`New York, NY
`
`United States
`
`Saint Louis, MO
`
`b.resolvers.Level3.net
`
`United States
`
`11
`
`

`

`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 17 of 430 PageID #: 33748
`
`c-73-75-147-
`169.hsd1.il.comcast.net
`dsl-187-143-149-218-
`dyn.prod-
`infinitum.com.mx
`ip184-186-86-
`246.tu.ok.cox.net
`
`134.170.179.74
`vpc-elb-rpdxtmweb-
`1283008362.us-west-
`2.elb.amazonaws.com
`cblmdm170-253-222-
`167.maxxsouthbb.net
`d104-205-174-
`99.abhsia.telus.net
`r74-193-146-
`183.lkchcmta01.lkchla.by.
`dh.suddenlink.net
`
`134.170.179.21
`google-public-dns-
`a.google.com
`a23-196-3-
`157.deploy.static.akamaite
`chnologies.com
`a23-49-4-
`89.deploy.static.akamaitec
`hnologies.com
`
`United States
`
`Hoffman Estates, IL
`
`AS7922 Comcast Cable
`Communications, LLC
`
`Mexico
`
`Coatzacoalcos, 30
`
`United States
`
`Bixby, OK
`
`United States
`
`United States
`
`Boardman, OR
`
`United States
`
`Shannon, MS
`
`Canada
`
`United States
`
`Greenville, MS
`
`United States
`
`AS8151 Uninet S.A. de C.V.
`AS22773 Cox
`Communications Inc.
`AS8075 Microsoft
`Corporation
`
`AS16509 Amazon.com, Inc.
`AS46687 BCI Mississippi
`Broadband,LLC
`AS852 TELUS
`Communications Inc.
`
`AS19108 Suddenlink
`Communications
`AS8075 Microsoft
`Corporation
`
`United States
`
`Mountain View, CA AS15169 Google Inc.
`
`United States
`
`Cambridge, MA
`
`AS20940 Akamai
`International B.V.
`
`United States
`
`Cambridge, MA
`
`40.90.10.165
`
`United States
`
`Cheyenne, WY
`
`65.158.122.18
`
`134.170.178.89
`
`134.170.179.25
`
`United States
`
`United States
`
`United States
`
`192.81.245.113
`
`United States
`
`New York, NY
`
`192.81.245.114
`
`United States
`
`New York, NY
`
`12
`
`AS2914 NTT America, Inc.
`AS8075 Microsoft
`Corporation
`AS209 Qwest
`Communications Company,
`LLC
`AS8075 Microsoft
`Corporation
`AS8075 Microsoft
`Corporation
`AS46555 TAKE-TWO
`INTERACTIVE
`SOFTWARE, INC.
`AS46555 TAKE-TWO
`INTERACTIVE
`SOFTWARE, INC.
`
`

`

`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 18 of 430 PageID #: 33749
`
`192.81.245.121
`
`United States
`
`New York, NY
`
`40.90.10.47
`
`United States
`
`Cheyenne, WY
`
`40.90.10.83
`msnbot-65-52-108-
`92.search.msn.com
`
`131.253.28.135
`
`
`United States
`
`Cheyenne, WY
`
`United States
`
`Boydton, VA
`
`United States
`
`AS46555 TAKE-TWO
`INTERACTIVE
`SOFTWARE, INC.
`AS8075 Microsoft
`Corporation
`AS8075 Microsoft
`Corporation
`AS8075 Microsoft
`Corporation
`AS8075 Microsoft
`Corporation
`
`23.
`
`Use of Handshake Protocol: I observed that GTA uses the following
`
`characteristic handshake to connect to and exchange game-play data with other players. The
`
`data I collected are attached as Appendix D and E to this Report. Two initial 52 byte blocks of
`
`data are exchanged between the peers. Each 52 byte block of data contains an identical eight
`
`byte sequence which serves to identify and confirm each peer as being a device wishing to
`
`participate in a GTA game-play session. Each 52 byte block of data also contains a unique eight
`
`byte sequence which serves as the unique identifier of the peer. Here the local Xbox
`
`(highlighted in green) identifies itself using the string 0c e2 f3 fd ba b4 f5 8a and the remote
`
`Xbox (highlighted in yellow) identifies itself using the string 20 6c f3 fd b3 24 0c f0.
`
`
`00000000 60 00 00 00 00 00 3b 15 20 01 00 00 0d 5d a5 99 `.....;. ....]..
`00000010 20 6c f3 fd b3 24 0c f0 20 01 00 00 0d 5d a5 99 l...$.. ....]..
`00000020 0c e2 f3 fd ba b4 f5 8a 01 04 00 00 00 00 04 04 ........ ........
`00000030 00 00 00 00 ....
`
` 00000000 60 00 00 00 00 00 3b 15 20 01 00 00 0d 5d a5 99 `.....;. ....]..
` 00000010 0c e2 f3 fd ba b4 f5 8a 20 01 00 00 0d 5d a5 99 ........ ....]..
` 00000020 20 6c f3 fd b3 24 0c f0 01 04 d1 4f c6 5d 04 04 l...$.. ...O.]..
` 00000030 01 00 00 00 ....
`
`
`13
`
`

`

`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 19 of 430 PageID #: 33750
`
`24.
`
`From this information I was able to identify in-game peer-to-peer data exchanges
`
`even if the port number in use differs from the standard UDP port 3075. The data I collected are
`
`attached as Appendix F to this Report. The following tables list a sample of in-game peer
`
`connections using non-standard ports and a breakdown of port ranges in use.
`
`source port
`peer
`64509
`dsl-189-179-120-22-dyn.prod-infinitum.com.mx
`57552
`customer-189-216-207-166.cablevision.net.mx
`49903
`static-50-53-156-116.bvtn.or.frontiernet.net
`48010
`189.215.49.182.cable.dyn.cableonline.com.mx
`47808
`162.255.235.254
`36938
`p18.vchighlandsnv.hsbnv.net
`27584
`dsl-201-110-157-229-dyn.prod-infinitum.com.mx
`18622
`jet-jet-internet-cpr.consolidated.net
`10184
`fixed-187-190-76-87.totalplay.net
`10080
`dsl-201-127-38-151-dyn.prod-infinitum.com.mx
`9424
`fixed-187-188-67-139.totalplay.net
`8732
`customer-TOR-169-205.megared.net.mx
`7521
`135.sub-174-197-0.myvzw.com
`Peers connected for in-game data exchange using non-standard ports.
`
`
`
`port range
`
`ports 0-999
`ports 10,000-
`19,999
`ports 20,000-
`29,999
`ports 30,000-
`39,999
`ports 40,000-
`49,999
`
`peer
`connections
`
`percent of
`total
`
`18
`
`26
`
`22
`
`20
`
`63
`
`5.26%
`
`7.60%
`
`6.43%
`
`5.85%
`
`18.42%
`
`14
`
`

`

`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 20 of 430 PageID #: 33751
`
`ports 50,000-
`59,999
`ports 60,000-
`64,509
`
`174
`
`19
`
`50.88%
`
`5.56%
`
`100.00%
`342
`all ports
`Connections per port range and percent of total..
`
`Usage of Relay Servers: I verified that GTA uses relay servers in addition to
`
`25.
`
`direct peer-to-peer connections to distribute gameplay data. The data I collected are attached as
`
`Appendix G to this Report. The table below shows endpoints connected during a gameplay
`
`session in which what appear to be Take-Two Interactive servers were handling gameplay traffic.
`
`The AS Number information for all of these IP addresses is listed as “AS46555 TAKE-TWO
`
`INTERACTIVE SOFTWARE, INC.” and the GeoIP information locates them in New York,
`
`NY. Furthermore they all belong to a relatively narrow IP address range, something that
`
`generally indicates a single owner. All of the IP addresses in question fall within the ranges
`
`192.81.241.114 to 192.81.241.123 and 192.81.245.111 to 192.81.245.126.
`
`Address
`
`192.81.245.124
`
`192.81.245.126
`
`192.81.245.114
`
`192.81.245.125
`
`192.81.245.112
`
`192.81.245.111
`
`192.81.241.123
`
`192.81.241.114
`
`AS Number
`AS46555 TAKE-TWO INTERACTIVE
`SOFTWARE, INC.
`AS46555 TAKE-TWO INTERACTIVE
`SOFTWARE, INC.
`AS46555 TAKE-TWO INTERACTIVE
`SOFTWARE, INC.
`AS46555 TAKE-TWO INTERACTIVE
`SOFTWARE, INC.
`AS46555 TAKE-TWO INTERACTIVE
`SOFTWARE, INC.
`AS46555 TAKE-TWO INTERACTIVE
`SOFTWARE, INC.
`AS46555 TAKE-TWO INTERACTIVE
`SOFTWARE, INC.
`AS46555 TAKE-TWO INTERACTIVE
`SOFTWARE, INC.
`
`City
`
`New York, NY
`
`New York, NY
`
`New York, NY
`
`New York, NY
`
`New York, NY
`
`New York, NY
`
`New York, NY
`
`New York, NY
`
`Country
`United
`States
`United
`States
`United
`States
`United
`States
`United
`States
`United
`States
`United
`States
`United
`States
`
`15
`
`

`

`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 21 of 430 PageID #: 33752
`
`192.81.245.115
`
`192.81.245.122
`
`192.81.245.116
`
`192.81.245.119
`
`192.81.245.121
`
`192.81.245.123
`
`192.81.241.100
`
`AS46555 TAKE-TWO INTERACTIVE
`SOFTWARE, INC.
`AS46555 TAKE-TWO INTERACTIVE
`SOFTWARE, INC.
`AS46555 TAKE-TWO INTERACTIVE
`SOFTWARE, INC.
`AS46555 TAKE-TWO INTERACTIVE
`SOFTWARE, INC.
`AS46555 TAKE-TWO INTERACTIVE
`SOFTWARE, INC.
`AS46555 TAKE-TWO INTERACTIVE
`SOFTWARE, INC.
`AS46555 TAKE-TWO INTERACTIVE
`SOFTWARE, INC.
`
`New York, NY
`
`New York, NY
`
`New York, NY
`
`New York, NY
`
`New York, NY
`
`New York, NY
`
`New York, NY
`
`United
`States
`United
`States
`United
`States
`United
`States
`United
`States
`United
`States
`United
`States
`
`26. Observation of proximity-based data connections: I tested GTA to determine if
`
`the peer-to-peer data transfer is dependent on the in-game proximity of the players sharing the
`
`data. I ran two scenarios; one in which two players (whom I was controlling on separate
`
`Xboxes) started apart and were brought together, and one in which the players started together
`
`and then moved apart. In both cases the network captures demonstrate that a higher rate of data
`
`exchange occurs when players are closer together than when they are farther apart. The data I
`
`collected are attached as Appendix H to this Report.
`
`27.
`
`The graph below represents the rate of data being exchanged between Test Player
`
`A and Test Player B in bytes per second as they start at remote points on the map and move
`
`closer together over the course of five minutes.
`
`16
`
`
`
`

`

`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 22 of 430 PageID #: 33753
`
`28.
`
`The graph below represents the rate of data being exchanged between Test Player
`
`A and Test Player B in bytes per second as they start from a proximal configuration and move to
`
`remote points on the map over the course of five minutes.
`
`
`
`
`I declare under penalty of perjury under the laws of the United States that the foregoing is
`
`true and correct. Executed on October 2, 2017 in Newport Beach, California.
`
`
`
`
`
`17
`
`

`

`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 23 of 430 PageID #: 33754
`Case 1:16-cv-00455-RGA Document 476-1 Filed 07/03/19 Page 2