UNITED STATES PATENT AND TRADEMARK OFFICE
`
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
` ____________
`
`SANDVINE CORPORATION AND SANDVINE INCORPORATED ULC,
`Petitioners,
`
`v.
`
`PACKET INTELLIGENCE, LLC,
`Patent Owner.
`
`____________
`
`Case No. IPR2017-00450
`U.S. Patent No. 6,771,646
` ____________
`
`DECLARATION OF BILL LIN, PH.D.
`
`Petitioners' EX1006 Page 1
`
`

`
`I, Bill Lin, hereby declare the following:
`
`I.
`
`BACKGROUND AND EDUCATION
`1. My name is Bill Lin, and I am a Professor of Electrical and Computer
`
`Engineering and an Adjunct Professor of Computer Science and Engineering at the
`
`University of California, San Diego.
`
`2.
`
`I received a Bachelor of Science in Electrical Engineering and
`
`Computer Sciences from University of California, Berkeley in May 1985; a
`
`Masters of Science in Electrical Engineering and Computer Sciences from the
`
`University of California, Berkeley in May 1988; and a Ph.D. in Electrical
`
`Engineering and Computer Sciences from the University of California, Berkeley in
`
`May 1991. Although I discuss my expert qualifications in more detail below, I
`
`also attach as Appendix A a recent and complete curriculum vitae, which details
`
`my educational and professional background and includes a selected listing of my
`
`relevant publications.
`
`3.
`
`I have been involved in research and technology in all aspects of
`
`computer networking and computer design problems, including the design of data
`
`networks, high-performance switches and routers, high-performance packet
`
`monitoring and measurements, many-core processors, and systems-on-chip
`
`designs.
`
` 1
`
`Petitioners' EX1006 Page 2
`
`

`
`4.
`
`I am a named inventor on five patents in the field of computer
`
`engineering, including several patents in the field of computer networking, and I
`
`have published over 170 journal articles and conference papers in top-tier venues
`
`and publications.
`
`5.
`
`I have also served or am currently serving as Associate Editor or
`
`Guest Editor for 3 ACM or IEEE journals, as General Chair on 4 ACM or IEEE
`
`conferences, on the Organizing or Steering Committees for 6 ACM or IEEE
`
`conferences, and on the Technical Program Committees of over 44 ACM or IEEE
`
`conferences.
`
`6.
`
`In summary, I have over 25 years of experience in research and
`
`development in the areas of computer networking and computer design.
`
`7.
`
`I have been retained by Erise IP, PA on behalf of Sandvine
`
`Corporation and Sandvine Incorporated ULC and am submitting this declaration to
`
`offer my independent expert opinion concerning certain issues raised in the
`
`Petition for inter partes Review (“Petition”). My compensation is not based on the
`
`substance of the opinions rendered here. As part of my work in connection with
`
`this matter, I have studied U.S. Patent No. 6,771,646 (“the ‘646 patent”), including
`
`the respective written descriptions, figures, claims, in addition to the original file
`
`history. Moreover , I have reviewed the Petition for Inter Partes Review of the
`
` 2
`
`Petitioners' EX1006 Page 3
`
`

`
`‘646 patent and I have also carefully considered the following references discussed
`
`in the Petition, in addition to all of the materials cited herein:
`
`• U.S. Patent No. 6,115,393 to Engel et al. (“Engel”), entitled “Network
`Monitoring,” filed July 21, 1995 and issued September 5, 2000
`[EX1007], including Engel’s Appendix VI (cited in Engel at 1:10-15,
`6:1-3, 43:25-56) [EX1009]
`
`• U.S. Patent No. 6,182,146 to Graham-Cumming, Jr. (“Graham-
`Cumming”), entitled “Automatic
`Identification of Application
`Protocols
`through Dynamic Mapping
`of Application-Port
`Associations,” filed June 27, 1997 and issued January 30, 2001
`[EX1010]
`
`• U.S. Patent No. 5,530,834 to Colloff et al. (“Colloff”), entitled “Set-
`Associative Cache Memory Having an Enhanced LRU Replacement
`Strategy,” filed March 3, 1994 and issued June 25, 1996 [EX1011]
`
`• U.S. Patent No. 5,793,954 to Baker et al. (“Baker”), entitled “System
`and Method for General Purpose Network Analysis,” filed December
`20, 1995 and issued August 11, 1998 [EX1012]
`II. LEGAL FRAMEWORK
`8.
`I have been informed by counsel and understand that the first step in
`
`an unpatentability analysis involves construing the claims, as necessary, to
`
`determine their scope. And, second, the construed claim language is then
`
`compared to the disclosure of the prior art. In proceedings before the United States
`
`Patent and Trademark Office, I have been informed that the claims of an unexpired
`
`patent are to be given their broadest reasonable interpretation in light of the
`
`specification from the perspective of a person of ordinary skill in the art at the time
`
`of the invention. I have been informed that the ‘646 Patent is unexpired.
`
` 3
`
`Petitioners' EX1006 Page 4
`
`

`
`9.
`
`In comparing the claims of the ‘646 Patent to the prior art, I have
`
`carefully considered the ‘646 Patent and its prosecution history based upon my
`
`experience and knowledge in the relevant field. In my opinion, the broadest
`
`reasonable interpretation of the claim terms of the ‘646 Patent is generally
`
`consistent with the ordinary and customary meaning of those terms, as one skilled
`
`in the relevant field would understand them at the time of the invention. For
`
`purposes of this proceeding, I have applied the claim constructions set forth in the
`
`claim construction section of the IPR Petition that this declaration accompanies
`
`when analyzing the prior art and the claims. For those terms that have not
`
`expressly been construed, I have applied the meaning of the claim terms of the
`
`‘646 Patent that is generally consistent with the terms’ ordinary and customary
`
`meaning, as a person of ordinary skill in the art would have understood them at the
`
`time of the invention.
`
`10.
`
`I have been informed by counsel that there are two ways in which a
`
`prior art patent or printed publication can be used to invalidate a patent. First, the
`
`prior art can be shown to “anticipate” the claim. Second, the prior art can be shown
`
`to “render obvious” the claim. My understanding of the two legal standards is set
`
`forth below.
`
`11.
`
`I have been informed by counsel that, in general, for a patent claim to
`
`be invalid as “anticipated” by the prior art, each and every feature of the claim
`
` 4
`
`Petitioners' EX1006 Page 5
`
`

`
`must be found, expressly or inherently, in a single prior art reference or product
`
`arranged as in the claim. Claim limitations that are not expressly found in a prior
`
`art reference are inherent if the prior art necessarily functions in accordance with,
`
`or includes, the claim limitations.
`
`12.
`
`I have also been informed by counsel that an inventor is not entitled to
`
`a patent if his or her invention would have been obvious to a person of ordinary
`
`skill in the field of the invention at the time the invention was made. I understand
`
`that a patent claim is not patentable under 35 U.S.C. § 103 if the differences
`
`between the patent claim and the prior art are such that the claimed subject matter
`
`as a whole would have been obvious at the time the claimed invention was made to
`
`a person having ordinary skill in the art to which the subject matter pertains.
`
`Obviousness, as I understand it, is based on the scope and content of the prior art,
`
`the differences between the prior art and the claim, the level of ordinary skill in the
`
`art, and, to the extent that they exist and have an appropriate nexus to the claimed
`
`invention (as opposed to prior art features), secondary indicia of non-obviousness.
`
`13.
`
`I have been informed that whether there are any relevant differences
`
`between the prior art and the claimed invention is to be analyzed from the view of
`
`a person of ordinary skill in the art at the time of the invention, in this case June
`
`30, 1999. As such, my opinions below as to a person of ordinary skill in the art are
`
` 5
`
`Petitioners' EX1006 Page 6
`
`

`
`as of the time of the invention, even if not expressly stated as such; for example,
`
`even if stated in the present tense.
`
`14.
`
`In analyzing the relevance of the differences between the claimed
`
`invention and the prior art, I have been informed that I must consider the impact, if
`
`any, of such differences on the obviousness or non-obviousness of the invention as
`
`a whole, not merely some portion of it. The person of ordinary skill faced with a
`
`problem is able to apply his or her experience and ability to solve the problem and
`
`also look to any available prior art to help solve the problem.
`
`15. An invention is obvious if a person of ordinary skill in the art, facing
`
`the wide range of needs created by developments in the field, would have seen an
`
`obvious benefit to the solutions tried by the applicant. When there is a design need
`
`or market pressure to solve a problem and there are a finite number of identified,
`
`predictable solutions, it would be obvious to a person of ordinary skill to try the
`
`known options. If a technique has been used to improve one device, and a person
`
`of ordinary skill in the art would recognize that it would improve similar devices in
`
`the same way, using the technique would have been obvious.
`
`16.
`
`It is my understanding that a precise teaching in the prior art directed
`
`to the subject matter of the claimed invention is not needed and that one may take
`
`into account the inferences and creative steps that a person of ordinary skill in the
`
`art would have employed in reviewing the prior art at the time of the invention.
`
` 6
`
`Petitioners' EX1006 Page 7
`
`

`
`For example, if the claimed invention combined elements known in the prior art
`
`and the combination yielded results that were predictable to a person of ordinary
`
`skill in the art at the time of the invention, then this evidence would make it more
`
`likely that the claim was obvious. On the other hand, if the combination of known
`
`elements yielded unexpected or unpredictable results, or if the prior art teaches
`
`away from combining the known elements, then this evidence would make it more
`
`likely that the claim that successfully combined those elements was not obvious.
`
`17.
`
`I understand that hindsight must not be used when comparing the
`
`prior art to the invention for obviousness.
`
`18.
`
`It is my understanding that obviousness may also be shown by
`
`demonstrating that it would have been obvious to modify what is taught in a single
`
`piece of prior art to create the subject matter of the patent claim. Obviousness may
`
`be shown by showing that it would have been obvious to combine the teachings of
`
`more than one item of prior art. In determining whether a piece of prior art could
`
`have been combined with other prior art or combined with or modified in view of
`
`other information within the knowledge of one of ordinary skill in the art, the
`
`following are examples of approaches and rationales that may be considered:
`
`•
`
`•
`
`Combining prior art elements according to known methods to yield
`predictable results;
`
`Simple substitution of one known element for another to obtain
`predictable results;
`
` 7
`
`Petitioners' EX1006 Page 8
`
`

`
`•
`
`•
`
`•
`
`•
`
`•
`
`Use of a known technique to improve similar devices (methods, or
`products) in the same way;
`
`Applying a known technique to a known device (method, or product)
`ready for improvement to yield predictable results;
`
`Applying a technique or approach that would have been "obvious to
`try" (choosing from a finite number of identified, predictable solutions,
`with a reasonable expectation of success);
`
`Known work in one field of endeavor may prompt variations of it for
`use in either the same field or a different one based on design
`incentives or other market forces if the variations would have been
`predictable to one of ordinary skill in the art; or
`
`Some teaching, suggestion, or motivation in the prior art that would
`have led one of ordinary skill to modify the prior art reference or to
`combine prior art reference teachings to arrive at the claimed
`invention.
`
`19.
`
`I understand that the rationale for modifying a reference and/or
`
`combining references may come from sources such as explicit statements in the
`
`prior art, or the knowledge of one of ordinary skill in the art, including any need or
`
`problem known in the field at the time, even if different from the specific need or
`
`problem addressed by the inventor of the patent claim.
`
`III. LEVEL OF A PERSON HAVING ORDINARY SKILL IN THE ART
`20.
`I understand that the factors considered when determining the
`
`ordinary level of skill in the art include the complexity of the technology involved
`
`at the time of the alleged invention, the types of problems faced in the art at that
`
`time, prior art solutions to those problems, and the educational level of active
`
`workers in the field. As discussed throughout this declaration, I am familiar with
`
` 8
`
`Petitioners' EX1006 Page 9
`
`

`
`each of these factors. See, e.g., Section VI (discussing the state of the art and
`
`technology involved at the time of the alleged invention).
`
`21.
`
`It is my opinion that a person having ordinary skill in the art at the
`
`time of the alleged invention of the ‘646 patent (June 30, 1999) would have had at
`
`least a bachelor’s degree, or equivalent, in electrical engineering, computer
`
`engineering, computer science, or a related field or an equivalent number of years
`
`of working experience, and one to two years of experience in networking
`
`environments, including at least some experience with network traffic monitors,
`
`analyzers, and/or firewalls or other intrusion detection systems.
`
`22. As demonstrated by my experience above, I more than meet the
`
`definition of one of ordinary skill in the art. In addition, throughout the 1990s and
`
`2000s, I worked with numerous people of ordinary skill in the field in question.
`
`IV. OVERVIEW OF THE ‘646 PATENT
`23. The ‘646 Patent was filed on June 30, 2000 and claims priority to a
`
`provisional application filed on June 30, 1999. The ‘646 Patent describes
`
`implementation of well known cache system in a packet monitoring application.
`
`EX1001, ‘646 patent at 2:37-51. The disclosed packet monitor includes an
`
`acquisition device, a parser, a flow-entry database, a lookup engine and associated
`
`cache subsystem, and a state processor. ‘646 patent at 36:39-67, 37:61-38:27.
`
` 9
`
`Petitioners' EX1006 Page 10
`
`

`
`24. An exemplary implementation of the disclosed system is shown in
`
`Fig. 11:
`
`
`
`25.
`
`In operation, the monitor receives a packet and determines whether
`
`the packet is part of an existing flow from a flow entry database. ‘646 patent at
`
`9:45-52; 10:5-9. Part of this determination includes building a signature from
`
`portions of the packet that are used to recognize a flow in the future. ‘646 patent at
`
`6:47-54; 11:59-62; 12:7-9. If the packet is in an initial state indicative of a new
`
`flow, then a state operation is performed on the packet to build a signature and a
`
`flow entry is created. ‘646 patent at 10:28-31; 11:5-7 (“[A] state process (set of
`
` 10
`
`Petitioners' EX1006 Page 11
`
`

`
`state operations) at a particular state may build a new signature for future
`
`recognition packets of the next state.”). If a packet is identified as being part of a
`
`known flow, i.e., the flow is in a final recognition state, then the flow entry is
`
`updated, including, for example, updating statistics for the flow. ‘646 patent at
`
`10:38-46 (“If the packet is found to have a matching flow-entry in the database …
`
`updating one or more statistical measures stored in the flow-entry.”); 11:62-66
`
`(“Once a packet is identified to be from a known flow, the state of the flow is
`
`known[.]”).
`
`26. The ‘646 patent further includes a teaching of determining whether a
`
`packet is part of an existing flow by utilizing a cache subsystem for storing and
`
`looking up flow entries for recently seen flows. ‘646 patent at 23:1-17; 30:13-22.
`
`The cache subsystem of the ‘646 patent is described as including many well-
`
`known concepts related to caching, such as replacing least recently used entries,
`
`keeping most recently used entries and the related concept of using content
`
`addressable memory cells (CAMs). ‘646 patent at 30:37-31:19.
`
`V. OVERVIEW OF THE RELEVANT FILE HISTORIES
`27. The ‘646 Patent was filed with 20 original claims. See Ex. 1013, ‘646
`
`File History at As-Filed Claims. On September 10, 2003, the Examiner rejected
`
`claims 7-11, 19, and 20 under §102(e) as anticipated by U.S. Patent No. 4,458,310
`
`(“Chang”) and claims 1 and 2 under §102(e) as anticipated by U.S. Patent No.
`
` 11
`
`Petitioners' EX1006 Page 12
`
`

`
`5,917,821 (“Gobuyan”). The Examiner further rejected claims 3-6 as obvious over
`
`Gobuyan in view of Chang and claims 12-18 as obvious over Chang in view of
`
`Carter. EX1013, ‘646 File History at 9/10/03 Rejection.
`
`28.
`
`In
`
`response, Applicants added
`
`the
`
`following
`
`limitations
`
`to
`
`independent claim 1:
`
`(i) “a conversational flow being an exchange of one or more packets in any
`
`direction as a result of an activity corresponding to the flow”;
`
`(ii) “a state processor …. being to perform any state operations specified for
`
`the state of the flow ….”.
`
`Ex. 1014, ‘646 File History at 2/10/04 Response, p. 2 (amended claims).
`
`Applicants distinguished their claims, as amended, by arguing that the cited
`
`reference, Gobuyan, did not disclose a “cache subsystem” or a “state processor.”
`
`Applicants further argued:
`
`“A conversational flow is not identified simply by the stations that are
`involved in a communication, but rather by the nature of the communication.
`e.g., the application program being invoked. […]
`
`Unlike Gobuyan, the present invention is able to identify and classify
`conversational flows rather than only connection flows. The reason for
`this is that some conversational flows involve more than one connection, and
`some even involve more than one exchange of packets between a client and
`server. Thus, there may be different states to a flow. This is particularly true
`when using client/server protocols such as RPC, DCOMP, and SAP, which
`enable a service to be set up or defined prior to any use of that service.
`
`An example of such a case is the SAP (Service Advertising Protocol), a
`NetWare (Novell Systems, Provo, Utah) protocol used to identify the
`
` 12
`
`Petitioners' EX1006 Page 13
`
`

`
`services and addresses of servers attached to a network. In the initial
`exchange, a client might send a SAP request to a server for print service.
`The server would then send a SAP reply that identifies a particular
`address—for example, SAP#5—as the print service on that server. Such
`responses might be used to update a table in a router, for instance, known as
`a Server Information Table. A client who has inadvertently seen this reply or
`who has access to the table (via the router that has the Service Information
`Table) would know that SAP#5 for this particular server is a print service.
`Therefore, in order to print data on the server, such a client would not need
`to make a request for a print service, but would simply send data to be
`printed specifying SAP#5. Like the previous exchange, the transmission of
`data to be printed also involves an exchange between a client and a server,
`but requires a second connection and is therefore independent of the initial
`exchange. In order to eliminate the possibility of disjointed conversational
`exchanges, it is desirable for a network packet monitor to be able to
`“virtually concatenate”—that is, to link—the first exchange with the second.
`If the clients were the same, the two packet exchanges would then be
`correctly identified as being part of the same conversational flow.”
`
`2/10/2004 Amendment, pp. 9-10 (emphasis original).
`
`29. The Examiner issued a Notice of Allowance noting that, among other
`
`things, while the prior art disclosed a cache memory subsystem that utilizes the use
`
`of flow entries, it lacked the ability to distinguish conversational data flow.
`
`EX1013, ‘646 File History at 4/14/04 Notice of Allowance.
`
`VI. BACKGROUND ON RELEVANT TECHNOLOGIES
`30. As discussed above, the subject matter of the ‘646 patent generally
`
`relates to the field of network monitoring of computer networks. To better
`
`understand my opinions on the inventions claimed in the ‘646 patent and their
`
`relation to Engel, Colloff, Graham-Cumming, and Baker, I provide below some
`
` 13
`
`Petitioners' EX1006 Page 14
`
`

`
`background on computer networking, network monitoring, and content addressable
`
`memories.
`
`A. Computer Networking and Protocol Layers
`31. Computer networks based on layered protocol architectures have been
`
`well-known since at least the 1970s. The two most dominant models of protocol
`
`layers are the OSI model and the Internet model. Both models were defined in
`
`1970s. The OSI model defines a seven-layer protocol stack whereas the Internet
`
`model defines a simpler five-layer protocol stack.
`
`32. The Internet model is illustrated in Figure 1(a) below. The physical
`
`layer is concerned with the low-level details of transmitting raw bits over some
`
`physical medium (e.g., fiber optics, copper cables, or radio frequency
`
`transmissions).
`
`Figure 1: The Internet protocol stack (a) and OSI model (b).
`
`
`
` 14
`
`Petitioners' EX1006 Page 15
`
`

`
`33. The link layer is responsible for controlling access to an individual
`
`network by a host or transferring data between two hosts on the same network.
`
`Examples of link layer protocols include Ethernet and WiFi. Such networks are
`
`commonly referred to as Layer 2 networks.
`
`34. For reasons that are beyond the scope of this matter, there are
`
`practical limits on the size of each individual network, and the individual networks
`
`may use different addressing schemes or frame formats, or more broadly, different
`
`link layer protocols. Therefore, an internetworking protocol layer is needed so that
`
`larger networks can be formed from individual networks that may span far
`
`geographical distances.
`
`35. This is the role of the network layer in the Internet protocol stack, and
`
`the network-layer protocol for the Internet is called the IP protocol (Internet
`
`Protocol). Among other functions, the IP protocol provides a uniform addressing
`
`scheme across the Internet so that hosts on different networks can talk to each
`
`other. The IP protocol layer is commonly referred to as Layer 3, and the Layer 3
`
`interconnection devices that are used to internetwork individual networks are
`
`commonly referred to as routers, which are responsible for forwarding (routing)
`
`packets across network boundaries.
`
`36. While the IP protocol layer provides for Internet addressing and
`
`routing functions, the transport layer is concerned with the end-to-end transport of
`
` 15
`
`Petitioners' EX1006 Page 16
`
`

`
`application-layer messages between application end-points. The two most widely
`
`used transport protocols are TCP and UDP, either of which can be used to transport
`
`application-layer messages. Whereas TCP provides a connection-oriented service
`
`to its applications that includes guaranteed delivery and congestion control, UDP
`
`provides a simpler connectionless service that does not provide for reliability or
`
`flow control.
`
`37. Finally, the application layer is concerned with the application itself.
`
`Examples of application layer protocols include HTTP (for web browsing), SMTP
`
`(for emails), and FTP (for file transfers).
`
`38. The seven-layer OSI reference model is illustrated in Figure 1(b)
`
`above. Five of the OSI model layers have roughly the same functions as their
`
`similarly named counterparts in the Internet model (namely, the physical, link,
`
`network, transport, and application layers). The OSI reference model has two
`
`additional layers, the session and presentation layers. The session layer controls
`
`the connections between computers, and the presentation layer establishes context
`
`between application-layer entities. These two layers are not present in the Internet
`
`model. The Internet model assumes that the services associated with these two
`
`layers are built into the application if they are needed.
`
` 16
`
`Petitioners' EX1006 Page 17
`
`

`
`B.
`Encapsulation
`39. To transport application-layer messages across the Internet using
`
`TCP/IP, the application-layer message is first encapsulated into TCP segments.
`
`Each TCP segment adds a TCP header, which contains information that the
`
`receiver-side will use for connection and application identification, sequencing,
`
`and reliable transmission. The TCP segments are in turn encapsulated into IP
`
`(Layer 3) packets. Each IP packet adds an IP header, which contains, among other
`
`information, protocol identification information and the source and destination IP
`
`addresses. Finally, the IP packets are in turn encapsulated into Layer 2 frames for
`
`forwarding within a Layer 2 network. Each Layer 2 frame adds a Layer 2 header,
`
`for example an Ethernet header if Ethernet is used. Among other information, the
`
`Ethernet header contains a Layer 2 address, also referred to as a MAC (media
`
`access control) address. This is illustrated in Figure 2 below. Similar
`
`encapsulations are performed when using another transport-layer protocol like
`
`UDP.
`
`Figure 2: Encapsulation of TCP/IP.
`
` 17
`
`
`
`Petitioners' EX1006 Page 18
`
`

`
`40. The ideas of encapsulation and de-encapsulation are well-known since
`
`at least the 1970s when the Internet protocol stack was first defined. The various
`
`encapsulation steps are performed by the sending host as application messages go
`
`through the different protocols layers, with a layer-specific header added at each
`
`layer, before the final encapsulated packet leaves the host and enters the network.
`
`Similarly, on the receiving end, the host is responsible for de-encapsulating the
`
`received packet, extracting relevant header and payloads at each layer of the
`
`protocol stack, performing protocol specific operations, and passing the de-
`
`encapsulated packet up the next layer for further processing. Since the de-
`
`encapsulation of packets requires the parsing and extraction of packet headers and
`
`payloads, techniques for packet parsing and extraction of specific information
`
`(e.g., protocol identification, port numbers, and address fields, etc) were also well-
`
`known since at least the 1970s.
`
`C. Network Monitoring
`41. The general goal of networking monitoring is to collect useful
`
`information from various parts of the network so that the network can be managed
`
`and controlled using the collected information. Most of the network devices are
`
`located in remote locations. Thus, network monitoring techniques have been
`
`developed to allow network management applications to check the states of remote
`
`network devices and collect information from them.
`
` 18
`
`Petitioners' EX1006 Page 19
`
`

`
`42. SNMP (Simple Network Management Protocol) is an Internet-
`
`standard protocol for collecting and organizing information about managed devices
`
`on IP networks and for modifying that information to change device behavior. It
`
`was initially specified in RFC 1067 in August 1988. (See EX1021, RFC 1067.)
`
`SNMP was further updated to version 2 in January 1996.
`
`43.
`
`In network monitoring using SNMP, monitored information is seen as
`
`a set of managed objects. MIBs (Management Information Bases) define the sets
`
`of objects being monitored.
`
`44. RMON (Remote Network Monitoring) is another important Internet
`
`standard that specifies how to monitor Internet traffic. RMON was originally
`
`standardized by RFC 1271 (see EX1022, RFC 1271) in November 1991, but it was
`
`later updated by RFC 1757 in February 1995. (See EX1023, RFC 1757.) The
`
`overall goal for RMON is to allow RMON-compliant network monitoring devices
`
`to be constructed. These devices are usually referred to as monitors or probes,
`
`which measure specific aspects of the network without interfering normal
`
`operations. These devices are often stand-alone devices and located in remote
`
`parts of the network. The RMON standard allows these devices to communicate
`
`over the network that they are monitoring.
`
` 19
`
`Petitioners' EX1006 Page 20
`
`

`
`45. Starting in the 1995-1996 timeframe, network monitoring products
`
`capable of monitoring performance at the application-level were becoming
`
`commercially available.
`
`is a
` “CoroNet’s CoroNet Management System (CMS)
`Windows-based management platform
`that ca also provide
`application-by-application fault and performance statistics across both
`LANs and WANs.” (See May 15, 1995, Network World, p. 17,
`available
`at:
`https://books.google.com/books?id=yBAEAAAAMBAJ&pg=PA37&
`dq=%22coronet+management+system%22&hl=en&sa=X&ved=0ahU
`KEwjDyuf_65TQAhXDKiYKHUJZDzEQ6AEIMTAF#v=onepage&
`q=%22coronet%20management%20system%22&f=false)
`
`“The firm, which requested that its name not be mentioned, is
`using CoroNet Systems’s CoroNet Management System (CMS) to
`determine how much bandwidth a particular application is using.”
`(See May 1, 1995, Network World, p. 20, available at:
`https://books.google.com/books?id=thIEAAAAMBAJ&pg=PA20&dq
`=%22coronet+systems%22&hl=en&sa=X&ved=0ahUKEwj8z76K85
`TQAhWBKyYKHUVgBEgQ6AEIHzAB#v=onepage&q=%22corone
`t%20systems%22&f=false)
`
`“Compuware Corp. takes the mystery out of understanding and
`managing application-level performance in large complex enterprise
`networks with EcoNet 2.0… EcoNet’s differentiation (and strength)
`lies in its capability to effectively monitor network conversations at
`the application level.” (See September 30, 1996, InfoWorld, p. N/4,
`available
`at:
`https://books.google.com/books?id=LjoEAAAAMBAJ&pg=RA1-
`PA53-
`IA5&dq=%22Econet%22+compuware&hl=en&sa=X&ved=0ahUKE
`wjUhrvB5pTQAhWEbSYKHSIfBx0Q6AEIPzAJ#v=onepage&q=%2
`2Econet%22%20compuware&f=false)
`
` “Compuware plans to announce Version 3.1 of EcoScope 3.1.
`The version has the capability to analyze application traffic at the
`protocol level, and also includes enhanced topology views and Web-
`
` 20
`
`Petitioners' EX1006 Page 21
`
`

`
`based reporting.” (See April 20, 1998, InfoWorld, p. 10, available at:
`https://books.google.com/books?id=vFAEAAAAMBAJ&pg=PA10&
`dq=infoworld+compuware+1998&hl=en&sa=X&ved=0ahUKEwj3u8
`6Ln7PQAhWM0YMKHRcaAMkQ6AEIOzAI%23v=onepage&q&f=
`false)
`
`
`46.
`
`In response to the growing need for network monitoring at the
`
`application-level, the RMON standard was extended to add support for network-
`
`and application-layer monitoring, including classes of protocols at the network,
`
`transport, session, presentation, and application layers. This extended RMON
`
`standard, known as RMON2, was standardized by RFC 2012 in January 1997.
`
`(See EX1024, RFC 2012.) To cover network monitoring on higher layers of
`
`traffic, the RMON2 MIB added ten more groups, including groups that cover
`
`Layer 3 traffic statistics and groups that cover traffic statistics by application
`
`protocols.
`
`D. Caches and Content-Addressable Memories
`47. A cache is a small, fast buffer used to keep a subset of the contents of
`
`a larger, slower memory that are likely to be accessed. Cache systems have been
`
`well known and widely utilized since at least the 1970s. (See EX1025, U.S. Patent
`
`No. 3,967,247 at 1:5-19.) Additionally, at least since the 1970s, it has been known
`
`for systems to utilize a Least-Recently-Used (LRU) algorithm for replacing items
`
`stored in the cache memory. (See U.S. Patent No. 3,967,247 at 3:56-57, 6:39-45,
`
`8:26-31, Fig. 4.)
`
` 21
`
`Petitioners' EX1006 Page 22
`
`

`
`48. By 1982, “virtually all modern large computer systems [had] cache
`
`memories.” (See EX1026, Smith at p. 473-474.) Additionally, as set forth in
`
`Smith, “in typical large, high-speed computers (e.g., Amdahl 470V/7, IBM 3033),
`
`main memory can be accessed in 300 to 600 nanoseconds; information can be
`
`obtained from a cache, on the other hand, in 50 to 100 nanoseconds.” (See Smith
`
`at p. 473.)
`
`49. Related to cache memories is content-addressable memory (CAM).
`
`CAM is a special type of fast memories that can search its entire memory to see if
`
`the input search data word is stored anywhere in it. In the basic CAM, also called
`
`a Binary CAM, the stored data words store just 0’s and 1’s. In addition to 0’s and
`
`1’s, Ternary-CAM allows each memory cell to store a third matching state of “X”
`
`or “don’t care” in the stored data word. This third matching state serves as a “wild
`
`card” when matching against an input search data word with a “0” or a “1” in the
`
`same bit position. This additional state is typically implemented by adding a
`
`m