EP 0 455 402 A2
`
`
`
`MATCHING
`
`IP RECORD
`
`MOVE PHYSICAL
`
`ADDRESS T0
`
`NODE RECORD
`
`
`
`
`
`
`
`INFORMATION
`
`IN NODE RECORD
`
`
`
`
`
`RETURN
`
`FIG. 12
`
`21
`
`LG v. Straight Path, |PR2015-00198
`Straight Path - Ex. 2025 - Page 245
`
`UPDATE STATE
`
`LG v. Straight Path, IPR2015-00198
`Straight Path - Ex. 2025 - Page 245
`
`

`
`EP 0 455' 402 A2
`
`
`ENTER
`
`
`
` 1302 IP
`ADDRESS
`
`= LOOPBACK
`
`
`
`ADDRESS
`
`
`
`NODE
`
`
`
`
`
`1308
`
`RETURN OK
`
`RETURN ERROR
`
`
`
`RETURN
`
`FIG. 13
`
`22
`
`LG v. Straight Path, |PR2015-00198
`Straight Path - Ex. 2025 - Page 246
`
`IN DOMAIN
`
`LG v. Straight Path, IPR2015-00198
`Straight Path - Ex. 2025 - Page 246
`
`

`
`1408
`
`EP 0 455 402 A2
`
`LIST ENTRY
`
`1402
`
` GET FIRST NODE
`
`1404
` IP
`ADDRESS
`
`
`
`
`
`RETURN ERROR
`
`RETURN OK
`
`RETURN
`
`FIG. 14
`
`23
`
`LG v. Straight Path, |PR2015-00198 '
`Straight Path - Ex. 2025 - Page 247
`
`MATCH
`
`?
`
`N
`
`GET NEXT NODE
`
`LIST ENTRY
`
`END OF~
`
`NODE LIST
`
`
`
`?
`
`Y
`
`
`
`LG v. Straight Path, IPR2015-00198
`Straight Path - Ex. 2025 - Page 247
`
`

`
`EP 0 455 402 A2
`
`ENTER
`
`HASH IP ADDRESS
`
`
`
`
`
`TO OPERATE
`
`TABLE POINTER
`
`
`
` ALLOCATE
`
`MEMORY FOR
`
`
`
`1502
`
`1504
`
`1506
`
`NODE RECORD
`
`
`
`
`
`STORE NODE DATA
`
`-AND
`
`STATE IN RECORD
`
`FIG. 15
`
`24
`
`LG v. Straight Path, |PR2015-00198
`Straight Path - Ex. 2025 - Page 248
`
`LG v. Straight Path, IPR2015-00198
`Straight Path - Ex. 2025 - Page 248
`
`

`
`EPo45§4o2A2
`
`AT
`INTERVAL
`
`EXPIRED
`
`
`
`
`SEND SNMP
`
`MESSAGE TO
`
`REQUEST NEXT
`
`
`
`
`AT ENTRY
`
`
`
`
`
`
`STORE-AT
`
`FIG. 17
`
`MORE
`
`AT TABLE
`
`"ENTRIES
`
`SET NEW
`
`AT INTERVAL
`
`25
`
`LG v. Straight Path, |PR2015-00198
`Straight Path - Ex. 2025 - Page 249
`
`
`
`LG v. Straight Path, IPR2015-00198
`Straight Path - Ex. 2025 - Page 249
`
`

`
`EPou5w2A2
`
`°
`
`FINDNODE
`
`FIG. 14
`
`
`
`
`
`
`INVALIDNODE
`
`
`
`
`FIG. 13
`
`
`
`
` Aoonooe
`
`
`FIG. 15
`
`
`
`UPDATE
`
`NODE STATE
`
`
`
`
`
`RETURN
`
`FIG. 17
`
`26
`
`LG v. Straight Path, |PR2015-00198
`Straight Path - Ex. 2025 - Page 250
`
`LG v. Straight Path, IPR2015-00198
`Straight Path - Ex. 2025 - Page 250
`
`

`
`*1
`
`')-
`
`0’
`
`European Patent Office
`Office 9l||'0Pée" ‘'95 b"eV°t5
`
`llllllllllllllllllllllllllllllllllllllll
`® Publication number: 0
`
`@
`
`EUROPEAN PATENT APPLICATION
`
`@ Application number: 913o3e43.o
`
`@ Int. ci.5: H04L 12/24
`
`@ Date of filing: 23.04.91
`
`
`
`Priority: 03.05.90 us 519137
`
`@ Inventor: Wu, Jeff c.
`2630 Wapiti Road
`Fort Collins, COl0|'3d° 30525 (US)
`
`Date of publication of application :
`06.11.91 Bulletin 91/45
`
`Designated Contracting States:
`DE FR GB
`
`Date of deferred publication of search report:
`11.01.95 Bulletin 95/02
`
`Representative: Colgan, Stephen James at al
`CARPMAELS 8- RANSFORD
`43 Bloomsbury Square
`London WC1A 2RA (GB)
`
`
`
`@ Applicant: Hewlett-Packard Company
`Mail Stop 20 B-O,
`_ 3000 Hanover Street
`Palo Alto, California 94304 (US)
`
`@ Automatic discovery of network elements.
`
`@ Disclosed is a computer network node dis-
`e
`covery system (.120).that provides a general way
`of discovering
`network elements, or nodes
`(100), connected to a computer network (118),
`and a specific algorithm for discovering nodes
`connected to a TCPIIP network. using the
`SNMP protocol available within the TCPIIP net-
`work software. Some nodes on a network, cal-
`led discovery agents, can convey knowledge of
`the existence of other nodes on the network.
`The network discovery system queries these
`agents and obtains the information they have
`about other nodes on the network.
`It
`then
`queries each of
`the nodes obtained to deter-
`mine if that node is also a discovery agent.
`In
`this manner. most of the nodes on a network
`can be discovered. The process of querying
`discovery agents to obtain a list of nodes known
`to the discovery agents is
`repeated at
`timed
`intervals to obtain infonnation about nodes that
`are not always active.
`In a TCPIIP network.
`discovery agents are nodes that
`respond to
`queries for an address translation table which
`translates intemet protocol
`(IP) addresses to
`physical addresses. The data from each node's
`address translation table is used to obtain both
`the IP and the physical address of other nodes
`on the network. These nodes are then queried
`to obtain additional
`information. After all
`the
`nodes on a network are discovered.
`the list of
`nodes is written to a database where it can be
`displayed by the network manager or other
`users of the network.
`
`EP0455402A3
`
`5118
`
`FIG.
`
`100
`
`110
`
`
`SOFTWARE
`NETWORK
`
`DISCOVERSYSTEM
`
`HAINMEMORY
`
`
` PROCESSING
`ELEMENT
`
`
`
`SYSTEH
`
`
`INTERFACE
`
`OPERATING
`
`;
`i...................................... ..
`
`Jouve. 18. rue Saint-Denis, 75001 PARIS
`
`LG v. Straight Path, |PR2015-00198
`Straight Path - Ex. 2025 - Page 251
`
`LG v. Straight Path, IPR2015-00198
`Straight Path - Ex. 2025 - Page 251
`
`

`
`EP 0 455 402 A3
`
`9))
`
`European Puznt .
`Officc
`
`EUROPEAN SEARCH REPORT
`
`Application Numba
`
`EP 91 30 3643
`
`Cdqw
`
`Y
`
`DOCUMENTS CONSIDERED TO BE RELEVANT
`(].ASSlF1CATlON OF THE
`Citldon of documull. with indication, what appropriate.
`of relevant pnsagts
`APPLICATION (Inl.CL5)
`GB-A-2 217 488 (RACAL DATA COMMUNICATIONS
`H04L12/24
`INC.)
`~
`line 14 - page 14.
`* page 10,
`line 18 - page 22,
`* page 15,
`* abstract *
`
`line 2 *
`line 13 *
`
`IEEE JOURNAL ON SELECTED AREAS IN
`COMMUNICATION.,
`Vol.7, no.7, September 1989. NEW YORK US
`pages 1104 - 1114, XP54539
`L.N.CASSEL ET AL ‘NETWORK MANAGEMENT
`ARCHITECTURES AND PROTOCOLS: PROBLEMS AND
`APPROACHES‘
`* paragraph V *
`
`Placeetuurn
`
`Dfluulaqlnhunflhum-A
`
`
`
`TECHNICAL FIEIDS
`SEARCHED
`0Il(.G.5)
`
`H04L
`
`Eufinn
`
`THE HAGUE
`CATEGORY OI-‘ CITED DOCUMENTS
`
`particulaxiy relevant if taken alone
`pardcularly relevant if combined with mocha
`document of the same ategnry
`: technological hackgound
`: non-Irma: dlsdasun
`: intermediate Coconut
`
`
`
`‘U03-<N
`
`
`
`
`
`
`
` [P0FORMI501(Ill!(FOOCOID
`
`
`
`Canosa Areste, C
`31 October 1994
`T : theory or pdndple undcdying the invention
`
`E : an-Iia punt Ioamcnt. but published on. or
`ms the filing late
`I) : lacuna! died in the nppliation
`lnlocunntdtedforotherrasons
`
`& : mane: of the same patent family. corresponding
`Cowman
`
`
`
`
`
`LG v. Straight Path, |PR2015-00198
`Straight Path - Ex. 2025 - Page 252
`
`LG v. Straight Path, IPR2015-00198
`Straight Path - Ex. 2025 - Page 252
`
`

`
`PCT
`
`WORLD INTELLECTUAI. PROPERTY ORGANIZATION
`International Bureau
`
`
`
`..v,T"
`
`INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCD
`
`
`
`(43) International Publication Date:
`29 October I992 (29.l0.92)
`
`
`
`PCT/US92/02995
`(74) Agent: PRAHL, Eric, L; Fish & Richardson, 225 Franklin
`Street, Boston, MA 021 l0-2804 (US).
`10 April 1992 (l0.04.92)
`
`
`
`(ll) lnteriiational Publication Number:
`
`WO 92/19054
`
`(51) lmemnllonal P319“! CI35SiI—|¢3tI0fl 5 5
`
`H04J 3/14, 3/24, H04L 12/56
`
`(21) lntemational Application Number:
`
`(22) International Filing Date:
`
`A1
`
`(30) Priority data:
`684,695
`
`12 April 1991 (l2.04.9l)
`
`US
`
`INC.
`(71) Applicant: CONCORD COMMUNICATIONS,
`[US/US]; 753 Forest Street, Marlboro, MA 01752 (US).
`
`
`
`
`
`
`
`
`(81) Designated States: AT (European patent), BE (European
`patent), CA, CH (European patent), DE (European pa-
`
`tent), DK (European patent), ES (European patent), FR
`
`(European patent), GB (European patent), GR (Euro-
`pean patent), IT (European patent), JP, LU (European
`
`patent), MC (European patent), NL (European patent),
`SE (European patent).
`
`
`
`Published
`
`
`
`
`
`
`With international search report.
`
`; 21 Joseph Road, Nor-
`(72) Inventors: FERDINAND, Engel
`thborough, MA 01532 (US). JONES, Kendall, S.
`; 90
`Boulder Road, Newton Center, MA 02159 (US). RO-
`BERTSON, Kary ; 398 North Road, Bedford, MA 01739
`(US). THOMPSON, David, M.
`; 5127 243rd Road, Red-
`mond, WA 98053 (US). WHITE, Gerard ; 133 Massa-
`poag Road, Tyngsborough, MA 01879 (US).
`
`(54) Title: NETWORK MONITORING
`
`
`
`2
`2
`I014
`“ lam
`mm 1°
`2
`2
`2
`4
`
`4
`2
`2
`to
`2'‘
`BEE
`
`E%2 2. 2 4
`
`
`
`
`
`
`
`Z-3
`
`2
`2
`2
`5 EM
`
`M10
`
` 2
`
`
`
`
`
`
`
`
`
`namw 18
`4
`2
`2
`'
`2
`14
`4
`
`
`
`
`
`
`
`
`2
`
`Ia
`
`I0
`
`2
`
`2
`
`la
`
`fl
`2
`
`2
`
`FILE senven
`2
`
`la
`
`6
`
`(57) Abstract
`
`
`
`
`Monitoring is done of communications which occur in a network of nodes (2), each communication being effected by a
`transmission of one or more packets among two or more communicating nodes (2), each communication complying with a prede-
`fined communication protocol selected from among protocols available in the network. The contents of packets are detected pas-
`sively and in real time, communication infonnation (130, I52, I78) associated with multiple protocols is derived from the packet
`contents.
`
`
`
`
`
`
`
`LG v. Straight Path, |PR2015-00198
`Straight Path - Ex. 2025 - Page 253
`
`LG v. Straight Path, IPR2015-00198
`Straight Path - Ex. 2025 - Page 253
`
`

`
`:5
`
`1;
`
`FOR THE PURPOSES OF INFORMATION ONLY
`
`Codes used to identify States party to the PCI‘ on the front pages of pamphlets publishing international
`applications under the PCT.
`
`AT
`AU
`BB
`88
`BF
`BC
`8.]
`BR
`CA
`CF
`CG
`CH
`CI
`CM
`CS
`DE
`UK
`
`Aualriu
`Australia
`Balflhulth
`Belgium
`Hurklna I-Inn
`Bulgaria
`uunin
`Hnuil
`(‘amudu
`('4:nlr..il Al'riI;.m Ru-public
`(‘ungo
`Swil/url.uId
`(‘élu il'l~oitc
`(':unuruuiI
`('u.-glmslm.-.|Li.|
`(it,-rnI.my
`IJcnm.uL
`
`hpuin
`Finland
`Francs:
`Gabon
`Unilcd Khlgdom
`(iuinca
`
`(iruccc
`lluugary
`[l.‘1|y
`Japan
`Ucnwcrutic Pu-np|u': Republic
`of Korea
`Republic of Kurua
`I icclllcnaluin
`bri l.':nL;1
`I uxulubourg
`Monaco
`
`Madagascar
`Mali
`Mongolia
`Mauritania
`Malawi
`Nclhcrland:
`Norway
`i
`Poland
`Iiolmtnia
`Russian Federation
`Sudan
`Sweden
`Senegal
`Soviet Union
`('iI..uJ
`Togo
`Uuilcd Slain: of Arm.-ricu
`
`LG v. Straight Path, |PR2015-00198
`Straight Path - Ex. 2025 - Page 254
`
`LG v. Straight Path, IPR2015-00198
`Straight Path - Ex. 2025 - Page 254
`
`

`
`wo 92/19054
`
`PCT/ US92/02995
`
`-1-
`
`NETWORK MONITORING
`
`Background of the Invention
`
`The invention relates to monitoring and managing
`communication networks for computers.
`Todays computer networks are large complex systems
`
`with many components from a large variety of vendors.
`
`These networks often span large geographic areas ranging
`
`from a campus-like setting to world wide networks. While
`
`the network itself can be used by many different types of
`
`organizations,
`
`the purpose of these networks is to move
`
`information between computers. Typical applications are
`
`electronic mail,
`
`transaction processing, remote database,
`
`query, and simple file transfer.
`
`Usually,
`
`the
`
`organization that has installed and is running the
`
`network needs the network to be running properly in order
`
`to operate its business.
`
`Since these networks are
`
`complex systems,
`
`there are various controls provided by
`
`the different equipment to control and manage the
`
`network. Network management is the task of planning,
`
`engineering, securing and operating a network.
`
`To manage the network properly,
`
`the Network
`
`Manager has some obvious needs. First,
`
`the Network
`
`Manager must trouble shoot problems.
`
`As the errors
`
`10
`
`15
`
`20
`
`develop in a running network,
`
`the Network Manager must
`
`25
`
`have some-tools
`
`that notify him of the errors and allow
`
`him to diagnose and repair these errors.
`
`Second,
`
`the
`
`Network Manager needs to configure the network in such a
`
`manner that the network loading characteristics provide
`To do
`
`the best service possible for the network users.
`
`30
`
`this the Network Manager must have tools that allow him
`
`visibility into access patterns,
`
`bottlenecks and general
`
`loading.
`
`with such data,
`
`the Network Manager can
`
`reconfigure the network components for better service.
`
`There are many different components that need to
`
`35
`
`be managed in the network.
`
`These elements can be,
`
`but
`
`LG v. Straight Path, |PR2015-00198
`Straight Path - Ex. 2025 - Page 255 .
`
`LG v. Straight Path, IPR2015-00198
`Straight Path - Ex. 2025 - Page 255
`
`

`
`\VC)92/19054
`
`PCT/ US92/02995
`
`-2-
`
`are not limited to: routers, bridges, PC's, workstations,
`minicomputers, supercomputers, printers, file servers,
`switches and pbx's.
`Each component provides a protocol
`for reading and writing the management variables in the
`machine. These variables are usually defined by the
`component vendor and are‘usually referred to as a
`Management Information Base (MIB). There are some
`standard MIB's, such as the IETF (Internet Engineering
`Task Force) MIB I and MIB II standard definitions.
`Through the reading and writing of HIE variables,
`software in other computers can manage or control the
`component.
`The software in the component that provides
`remote access to the MIB variables is usually called an
`agent. Thus, an individual charged with the
`responsibility of managing a large network often
`various tools to manipulate the MIB's of various agents
`
`willuuse
`
`on the network.
`Unfortunately,
`the standards for accessing HIBS
`are not yet uniformly provided nor are the MIB
`definitions complete enough to manage an entire network.
`The Network Manager must therefore use several different
`types of computers to access the agents in the network.
`This poses a problem, since the errors occurring on the
`network will tend to show up in different computers and
`the Network Manager must therefore monitor several
`different screens to determine if the network is running
`properly. Even when the Network Manager is able to
`accomplish this task, the tools available are not
`sufficient for the Network Manager to function properly.
`Furthermore, there are many errors and loadings on
`Flow
`
`the network that are not reported by agents.
`control problems, retransmissions, on-off segment
`loading, network capacities and utilizations are some off
`the types of data that are not provided by the agents.
`
`10
`
`15
`
`20
`
`25
`
`30
`
`LG v. Straight Path, |PR2015-00198
`Straight Path - Ex. 2025 - Page 256
`
`LG v. Straight Path, IPR2015-00198
`Straight Path - Ex. 2025 - Page 256
`
`

`
`W0 92/19054
`
`PCT/ US92/02995
`
`-3-
`
`Simple needs like charging each user for actual network
`
`usage are impossible.
`Su
`
`ar
`
`of the
`
`nvention
`
`In general,
`
`in one aspect,
`
`the invention features
`
`monitoring communications which occur in a network of
`
`nodes, each communication being effected by a
`
`transmission of one or more packets among two or more
`
`communicating nodes, each communication complying with a
`
`predefined communication.protocol selected from among
`
`protocols available in the network.
`
`The contents of
`
`packets are detected passively and in real time,
`
`communication information associated with multiple
`
`protocols is derived from the packet contents.
`
`Preferred embodiments of the invention include the
`
`"The communication‘information
`following features.
`derived from the packet contents is associated with
`
`multiple layers of at least one of the protocols.
`
`In general,
`
`in another aspect,
`
`the invention
`
`10
`
`‘15
`
`features monitoring communication dialogs which occur in
`a network of nodes, each dialog being effected by a
`
`20
`
`transmission of one or more packets among two or more
`
`communicating nodes, each dialog complying with a
`
`predefined communication protocol selected from among
`
`protocols available in the network.
`
`Information about
`
`the states of dialogs occurring in the‘network and which
`
`comply with different selected protocols available in the
`
`network is derived from the packet contents.
`
`Preferred embodiments of the invention include the
`
`following features.
`
`A current state is maintained for
`
`each dialog, and the current state is updated in response
`
`to the detected contents of transmitted packets.
`
`For
`
`each dialog,
`
`a history of events is maintained based on
`
`information derived from the contents of packets,
`
`and the
`
`25
`
`30
`
`history of events is analyzed to derive information about
`35 _the dialog.
`
`The analysis of the history includes
`
`LG v. Straight Path, |PR2015-00198
`Straight Path - Ex. 2025 - Page 257
`
`LG v. Straight Path, IPR2015-00198
`Straight Path - Ex. 2025 - Page 257
`
`

`
`W0 92/ 19054
`
`PCT/US92/02995
`
`-4-
`
`counting events and gathering statistics about events;
`The history is monitored for dialogs which are inactive,
`and dialogs which have been inactive for a predetermined
`For example,
`the current
`period of time are purged.
`state is updated to data state in response to observing
`the transmission of at least two data related packets
`from each node.
`Sequence numbers of data related packets
`stored in the history of events are analyzed and
`
`retransmissions are detected based on the sequence
`numbers.
`The the current state is updated based on each
`new packet associated with the dialog; if an updated
`current state cannot be determined,
`information about
`prior packets associated with the dialog is consulted as
`an aid in updating the state.
`The history of events may
`be searched to identify the initiator of a dialog.
`The full set of packets associated with a dialog
`up to a point in time completely define a true state of
`the dialog at that point in time, and the step of
`updating the current state in response to the detected
`contents of transmitted packets includes generating a
`current state (e.g., "unknown") which may not conform to
`the true state. The current state may be updated to the
`true state based on information about prior-packets
`transmitted in the dialog.
`R’
`Each communication may involve multiple dialogs
`corresponding to a specific protocol. Each protocol
`layer of the communication may be parsed and analyzed to
`isolate each dialog and statistics may be kept for each
`dialog. The protocols may include a connectionless-type
`protocol in which the state of a dialog is implicit in
`transmitted packets, and the step of deriving information
`about the states of dialogs includes inferring the states
`of the dialogs from the packets. Keeping statistics for
`protocol layers may be temporarily suspended when parsing
`
`10
`
`15
`
`20
`
`25
`
`30
`
`LG v. Straight Path, |PR2015-00198
`Straight Path - Ex. 2025 - Page 258
`
`LG v. Straight Path, IPR2015-00198
`Straight Path - Ex. 2025 - Page 258
`
`

`
`W0 92/19054
`
`PCT/US92/02995
`
`-5-
`
`and statistics gathering is not rapid enough to match the
`rate of packets to be parsed.
`
`In general,
`in another aspect,
`the invention
`features monitoring the operation of the network with
`
`respect to specific items of performance during normal
`
`operation, generating a model of the network based on the
`
`monitoring, and setting acceptable threshold levels for
`
`the specific items of performance based on the model.
`
`In
`
`preferred embodiments,
`
`the operation of the network is
`
`10
`
`monitored with respect to the specific items of
`
`performance during periods which may include abnormal
`
`operation.
`
`In general,
`
`in another aspect,
`
`the invention
`
`features the combination of a monitor connected to the
`
`‘"15
`
`network medium for passively, and in real time,
`
`monitoring transmitted packets and storing information
`
`about dialogs associated with the packets, and a
`
`workstation for receiving the information about dialogs
`
`from the monitor and providing an interface to a user. In
`preferred embodiments,
`the workstation includes means for
`
`20
`
`enabling a user to observe events of active dialogs.
`
`In general,
`
`in another aspect,
`
`the invention
`
`features apparatus for monitoring packet communications
`
`in a network of nodes in which communications may be in
`accordance with multiple protocols.
`The apparatus.
`
`25
`
`includes a monitor connected to a communication medium of
`
`the network for passively, and in real time, monitoring
`
`transmitted packets of different protocols and storing
`
`information about communications associated with the
`
`30
`
`packets,
`
`the communications being in accordance with
`
`different protocols, and a workstation for receiving the
`
`information about the communciations from the monitor and
`
`providing an interface to a user.
`
`The monitor and the
`
`workstation include means for relaying the information
`
`35 about multiple protocols with respect to communication in
`
`LG v. Straight Path, |PR2015-00198
`Straight Path - Ex. 2025 - Page 259
`
`LG v. Straight Path, IPR2015-00198
`Straight Path - Ex. 2025 - Page 259
`
`

`
`WO 92/19054
`
`PCT/ US92/02995
`
`-.-6-
`
`the different protocols from the monitor to the
`workstation in accordance with a single common network
`
`The
`
`management protocol.
`the invention
`in another aspect,
`In general,
`features diagnosing communication problems between two
`nodes in a network of nodes interconnected by links.
`operation of the network is monitored with respect to
`specific items of performance during normal operation.
`model of normal operation of the network is generated
`Acceptable threshold levels are
`based on the monitoring.
`set for the specific items of performance based on the
`model.
`The operation of the network is monitored with
`respect to the specific items of performance during
`periods which may include abnormal operation. when
`abnormal operation of the network with respect tow
`communication between the two nodes is detected,
`the
`problem is diagnosed by separately analyzing the
`performance of each of the nodes and each of the links
`‘connecting the two nodes to isolate the-abnormal
`
`A
`
`operation.
`the invention
`in another aspect,
`In general,
`features a method of timing the duration of a transaction
`of interest occurring in the course of communication
`
`the beginning of the
`between nodes of a network,
`transaction being defined by the sending of a first
`packet of a particular kind from one node to the other,
`and the end of the transaction being defined by the
`
`sending of another packet of a particular kind between
`the nodes.
`In the method, packets transmitted in the
`
`network are monitored passively and in real time. The
`beginning time of the transaction is determined based on
`the appearance of the first packet.
`A determination is
`made of when the other packet has been transmitted.
`The
`
`timing of the duration of the transaction is ended upon
`
`10
`
`15
`
`20
`
`25
`
`30
`
`35
`
`the appearance of the other packet.
`
`LG v. Straight Path, |PR2015-00198
`Straight Path - Ex. 2025 - Page 260
`
`LG v. Straight Path, IPR2015-00198
`Straight Path - Ex. 2025 - Page 260
`
`

`
`W0 92/ 1 9054
`
`PCT/ US92/02995
`
`.. 7 -
`
`In general,
`
`in another aspect,
`
`the invention
`
`features,
`
`tracking node address to node name mappings in
`
`a network of nodes of the kind in which each node has a
`
`possibly nonunique node name and a unique node address
`
`within the network and in which node addresses can be
`
`assigned and reassigned to node names dynamically using a
`
`name binding protocol message incorporated within a
`
`packet.
`
`In the method, packets transmitted in the
`
`network are monitored, and a table linking node names to
`
`10
`
`node addresses is updated based on information contained
`
`in the name binding protocol messages in the packets.
`
`15
`
`20
`
`25
`
`30
`
`one advantage of the invention is that it enables
`
`a network manager to passively monitor multi-protocol
`In
`
`networks at multiple layers of the communications.
`
`addition, it organizes and presents network performance
`
`statistics in terms of dialogs which are occurring at any
`
`desired level of the communication. This technique of
`
`organizing and displaying network performance statistics
`
`provides an effective and useful view of network
`
`performance and facilitates a quick diagnosis of network
`
`problems.
`
`other advantages and features will become apparent
`
`from the following description of the preferred
`
`embodiment and from the claims.
`
`t
`
`ed
`
`od'
`
`ts
`
`Fig.
`
`1 is a block diagram of a network;
`
`Fig. 2 shows the layered structure of a network
`
`communication and a protocol tree within that layered
`
`environment;
`
`Fig.
`
`3 illustrates the structure of an
`
`ethernet/IP/TCP packet;
`
`Fig. 4 illustrates the different layers of a
`
`communication between two nodes;
`
`'
`
`Fig. 5 shows the software modules within the
`
`35
`
`Monitor;
`
`LG v. Straight Path, |PR2015-00198
`Straight Path - Ex. 2025 - Page 261
`
`LG v. Straight Path, IPR2015-00198
`Straight Path - Ex. 2025 - Page 261
`
`

`
`WO 92/19054
`
`PCI‘/US92/02995
`
`-3-
`
`Fig. 6 shows the structure of the Monitor software
`in terms of tasks and intertask communication mechanisms;
`Figs. 7a-c show the STATS data structures which
`store performance statistics relating to the the data
`
`link layer;
`Fig. 8 is a event/state table describing the
`operation of the state machine for a TCP connection;
`Fig. 9a is a history data structure that is
`identified by a pointer found in the appropriate dialog
`
`10
`
`statistics data within STATS;
`
`Fig. 9b is a record from the history table;
`
`Fig. 10 is a flow diagram of the
`
`Look_for_Data_State routine;
`Fig. 11 is a_f1ow diagram of the
`Look_for_Initiator routine that is called by the
`Look_for_Data_State routine;
`Fig. 12 is a_f1ow diagram of the
`Look_for_£etransmission routine which is called by the
`Look_at;History‘routine;
`Fig. 13 is a diagram of the major steps in
`processing a frame through the Real Time Parser (RTP);
`Fig. 14 is a diagram of the major steps in the
`
`processing a statistics threshold event;
`Fig. 15 is a diagram of the major steps in the
`
`processing of a database update;
`Fig. 16 is a diagram of the major steps in the
`
`15
`
`20
`
`25
`
`processing of a monitor control request;
`Fig. 17 is a logical map of the network as
`
`30
`
`displayed by the Management Workstation;
`Fig. 18 is a basic summary tool display screen;
`Fig. 19 is a protocol selection menu that may be
`
`invoked through the summary tool display screen;
`
`Figs. 20a-g are examples of the statistical
`variables which are displayed for different protocols;
`
`LG v. Straight Path, |PR2015-00198
`Straight Path - Ex. 2025 - Page 262
`
`LG v. Straight Path, IPR2015-00198
`Straight Path - Ex. 2025 - Page 262
`
`

`
`W0 92/ I 9054
`
`PCT/US92/02995
`
`-9-
`
`Fig. 21 is an example of information that is
`
`displayed in the dialogs panel of the summary tool
`
`display screen;
`
`_
`
`Fig. 22 is a basic data screen presenting a rate
`
`values panel, a count values panel and a protocols seen
`
`panel;
`
`Fig. 23 is a traffic matrix screen;
`
`Fig. 24 is a flow diagram of the algorithm for
`
`adaptively establishing network thresholds based upon
`
`10
`
`actual network performance;
`
`Fig. 25 is a simple multi-segment network;
`Fig. 26 is a flow diagram of
`
`the operation of the
`
`diagnostic analyzer algorithm;
`
`15
`
`Fig. 27 is a flow diagram of the source node
`analyzer algorithm;
`2
`I
`i
`Fig. 28 is a flow diagram of the sink node
`
`analyzer algorithm;
`
`Fig. 29 is a flow diagram of the link analysis
`
`logic;
`
`20
`
`Fig. 30 is a flow diagram of the DLL problem
`
`checking routine;
`
`Fig. 31 is a flow diagram of the IP problem
`
`checking routine;
`
`Fig. 32 is a flow diagram of the IP link component
`
`25
`
`problem checking routine;
`Fig. 33 is a flow diagram
`
`of
`
`the DLL link
`
`component problem checking routine;
`
`Fig. 34 shows the structure of the event timing
`
`30
`
`database;
`Fig. 35 is a flow diagram of the operation of the
`event timing module (ETM)
`in the Network Monitor;
`
`Fig. 36 is a network which includes an Appletalk®
`
`segment;
`
`Fig. 37 is a Name Table that is maintained by the
`
`35
`
`Address Tracking Module (ATM);
`
`LG v. Straight Path, |PR2015-00198
`Straight Path - Ex. 2025 - Page 263
`
`LG v. Straight Path, IPR2015-00198
`Straight Path - Ex. 2025 - Page 263
`
`

`
`W092/19054
`
`PCT/US92/02995
`
`Fig. 38 is a flow diagram of the operation of the
`
`ATM; and
`Fig. 39 is a flow diagram of the operation of the
`
`ATM.‘
`
`5
`
`Also attached hereto before the claims are the
`
`following appendices:
`Appendix I identifies the SNMP MIB subset that is
`supported by the Monitor and the Management Workstation
`
`10
`
`(2 P3988):
`Appendix II defines the extension to the standard
`MIB that are supported by the Monitor and the Management
`
`Workstation (25 pages);
`Appendix III is a summary of the protocol
`- variables for which the Monitor gathers statistics and a
`brief description of the variables, where appropriate (17
`
`15
`
`P3938);
`
`Appendix IV is a list of the summary Tool Values
`Display Fields with brief descriptions (2 pages); and
`Appendix V is a description of the actual screens
`
`20
`
`for the Values Tool
`
`S
`
`T
`
`d
`
`wo
`
`:
`
`(34 pages).
`on
`
`t‘
`
`A typical network, such as the one shown in Fig.
`includes at least three major components, namely,
`1,
`network nodes 2, network elements 4 and communication
`
`25
`
`lines 6.
`
`Network nodes 2 are the individual computers on
`
`the network. They are the very reason the network
`exists.
`They include but are not limited to workstations
`(WS), personal computers (PC), file servers (FS), compute
`servers (CS) and host computers (e.g., a VAX),
`to name
`but a few.
`The term server is often used as though it
`in fact,
`just a
`
`was different from a node, but it is,
`
`30
`
`node providing special services.
`In general, network elements 4 are anything that
`participate in the service of providing data movement in
`
`35
`
`LG v. Straight Path, |PR2015-00198
`Straight Path - Ex. 2025 - Page 264
`
`LG v. Straight Path, IPR2015-00198
`Straight Path - Ex. 2025 - Page 264
`
`

`
`W0 92/ 19054
`
`PCT/US9Z/02995
`
`a network, i.e., providing the basic communications.
`
`They include, but are not limited to,
`routers,
`bridges, gateways, multiplexers, switches and connectors.
`
`LAN's,
`
`Bridges serve as connections between different network
`
`segments.
`
`They keep track of the nodes which are
`
`connected to each of the segments to which they are
`
`connected. when they see a packet on one segment that is
`
`addressed to a node on another of their segments,
`
`they
`
`grab the packet from the one segment and transfer it to
`
`the proper segment.
`
`Gateways generally provide
`
`connections between different network segments that are
`
`operating under different protocols and serve to convert
`
`communications from one protocol to the other. Nodes
`
`send packets to routers so that they may be directed over
`
`the appropriate segments to the intended destination‘
`node.
`
`Finally, network or communication lines 6 are the
`
`components of the network which connect nodes 2 and
`
`elements 4 together so that communicatons between nodes 2
`
`may take place.
`
`They can be private lines,
`
`satellite
`
`lines or Public Carrier lines.
`
`They are expensive
`
`resources and are usually managed as separate entities.
`
`often networks are organized into segments 8 that are
`
`connected by network elements 4.
`
`A segment 8 is a
`
`section of a LAN connected at a physical level (this may
`
`include repeaters). Within a segment, no protocols at
`
`layers above the physical layer are needed to enable
`
`signals from two stations on the same segment to reach
`
`each other (i.e., there are no routers, bridges,
`
`10
`
`15
`
`20
`
`25
`
`30
`
`gateways...).
`
`The Network Monitor and the Management florkstation:
`
`In the described embodiment,
`
`there are two basic
`
`elements to the monitoring system which is to be
`
`described, namely, a Network Monitor 10 and a Management
`
`LG v. Straight Path, |PR2015-00198
`Straight Path - Ex. 2025 - Page 265
`
`LG v. Straight Path, IPR2015-00198
`Straight Path - Ex. 2025 - Page 265
`
`

`
`W0 92/19054
`
`PCT/ US92/02995
`
`-12-
`
`Workstation 12. Both elements interact with each other
`
`over the local area network (LAN).
`Network Monitor 10 (referred to hereinafter simply
`as Monitor 10)
`is the data collection module which is
`attached to the LAN.
`It is a high performance real time
`front end processor which collects packets on the network
`and performs some degree of analysis to search for actual
`or potential problems and to maintain statistical
`information for use in later analysis.
`In general, it
`performs the following functions.
`It operates in a
`promiscuous mode to capture and analyze all packets on
`the segment and it extracts all items of interest from
`It generates alarms to notify the Management
`the frames.
`It
`Workstation of the occurence of significant events.
`receives commands from the Management Workstation,
`
`processes them appropriately and returns responses.
`Management Workstation 12 is the operator
`interface.
`It collects and presents troubleshooting and
`performance information to the user.
`It is based on the
`sunNet Manager
`(SNM) product and provides a graphical
`network-map-based interface and sophisticated data
`presentation and analysis tools.
`It receives information
`from Monitor 10, stores it and displays the information
`inpvarious ways.
`It also instructs Monitor 10 to perform"
`in turn, sends responses
`certain actions. Monitor 10,
`and alarms to Management Workstation 12 over either the
`primary LAN or a backup serial link 14 using SNMP with
`the MIB extensions defined later.
`
`These devices can be connected to each other over
`
`10
`
`15
`
`20
`
`25
`
`30
`
`various types of networks and are not limited to
`connections over a local area network. As indicated in
`
`Fig. 1,
`
`there can be multiple Workstations 12 as well as
`
`multiple Monitors 10.
`Before describing these components in greater
`
`35
`
`detail, background information will first be reviewed
`
`LG v. Straight Path, |PR2015-00198
`A SflamhtPafl1-Ex.2025-Page266
`
`LG v. Straight Path, IPR2015-00198
`Straight Path - Ex. 2025 - Page 266
`
`

`
`W0 92/ I 9054
`
`PCT/US92/02995
`
`regarding communication protocols which specify how
`
`communications are conducted over the network and
`
`regarding the structure of the packets.’
`
`The Protocol Tree:
`
`As shown in Fig. 2, communication over the network
`
`is organized as a series of layers or levels, each one
`
`built upon the next lower one, and each one specified by
`V
`Each
`one or more protocols (repre