`
`
`
`
`
`
`
`EXHIBIT G
`
`NOAC Ex. 1036 Page 1
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 2 of 25 PageID #: 1824
`
`This presentation is accompanied by a voice-over. If you cannot hear the narrator’s
`voice at this time, please adjust your computer’s audio settings.
`
`1
`
`NOAC Ex. 1036 Page 2
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 3 of 25 PageID #: 1825
`
`Plaintiff Packet Intelligence presents this tutorial to familiarize the Court with the
`technology of the patents in suit.
`
`2
`
`NOAC Ex. 1036 Page 3
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 4 of 25 PageID #: 1826
`
`The patents‐in‐suit are all related and claim priority to the same provisional application.
`The ‘099, ‘725, ‘646, and ‘751 patent all were filed on the same day, June 30, 2000. The
`‘789 patent was filed as a Continuation application to the ‘099 patent.
`
`3
`
`NOAC Ex. 1036 Page 4
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 5 of 25 PageID #: 1827
`
`The patents‐in‐suit relate to a network monitor that analyzes network communications.
`According to the patents, the monitor determines two things. First, the network monitor
`determines the underlying protocols used within a network communication. Second, the
`monitor uses the identified protocols and data transmitted within those protocols to
`determine the application responsible for the communication.
`
`The packets are analyzed as they pass through a connection point on a computer network.
`As the packets are received, they are analyzed to determine the underlying protocols and
`ultimately the application related to the communication. This process may involve
`analyzing multiple packets before the related protocols and applications are determined.
`
`4
`
`NOAC Ex. 1036 Page 5
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 6 of 25 PageID #: 1828
`
`A brief explanation of certain background concepts related to the patents‐in‐suit will now
`be provided.
`
`5
`
`NOAC Ex. 1036 Page 6
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 7 of 25 PageID #: 1829
`
`Consider users in separate locations making a Skype call to each other via their computers.
`Each location is using the Skype application, and this application uses a proprietary Skype
`protocol to handle the communication. Thus, on detection of the Skype protocol, the
`network monitor can identify the application responsible for the transmission as Skype.
`
`Note that the Skype application is different from the Skype protocol. The application makes
`use of the protocol to communicate.
`
`6
`
`NOAC Ex. 1036 Page 7
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 8 of 25 PageID #: 1830
`
`A Skype transmission from User 1 to User 2, however, must be processed by other
`components and/or devices before it arrives at User 2. These other components and/or
`devices handle lower‐level network communications that are required for User 1's
`computer to talk to User 2's computer. Each protocol participating in this transmission is
`typically correlated with a particular layer in a layered networking model.
`
`7
`
`NOAC Ex. 1036 Page 8
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 9 of 25 PageID #: 1831
`
`The Open Systems Interconnection model (OSI) is a model of the protocol layers often used
`in network communication. This model was developed as part of a project at the
`International Standards Organization, and it contains the seven layers shown here.
`
`The Application Layer, or layer 7, is the highest level layer. The Physical Layer, or
`layer 1, is the lowest level layer.
`
`These layers provide a model for describing common formats used in network
`communication. Not all network communications use each layer contained in the
`model.
`
`8
`
`NOAC Ex. 1036 Page 9
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 10 of 25 PageID #: 1832
`
`Each layer serves a particular purpose within the network communication model.
`Throughout the following discussion, we will refer to a subset of the OSI layers to illustrate
`networking concepts. However, these concepts are applicable to each layer used within a
`network communication.
`
`The Application layer (or layer 7) represents the application protocol being used in a
`network communication. This is typically the protocol that the user's application is using to
`communicate.
`
`For instance, the Skype protocol is used by Skype applications, and the HTTP protocol is
`used by web browsers.
`
`The Network layer (or layer 3) includes protocols such as the Internet Protocol, also known
`as IP, that are used to support network routing decisions that guide traffic through the
`Internet.
`
`The Physical layer (or layer 1) includes protocols such as Ethernet, that control the
`transmission of raw data onto the wire.
`
`9
`
`NOAC Ex. 1036 Page 10
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 11 of 25 PageID #: 1833
`
`Protocol layering is accomplished by encapsulation, which is taking a higher level protocol
`message and packaging it up into one or more lower‐level protocol messages. Several
`layers, or protocols, may be involved in a network communication.
`
`Let’s demonstrate the concept of encapsulation by continuing with our Skype example. For
`this example, we will only discuss layers 7, 3, and 1. However, the concepts described
`typically apply to each layer used within a network communication.
`
`10
`
`NOAC Ex. 1036 Page 11
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 12 of 25 PageID #: 1834
`
`Shown here is a Skype message that is being sent from User 1's computer in Los Angeles to
`User 2's computer. This message is written in an application layer protocol, the Skype
`protocol. This is IOS layer 7. Prior to transmission, it is broken into one or more IP
`messages (or packets) that are written in the IP protocol. The IP protocol layer is layer 3.
`Each of these IP packets includes a header with information specific to the IP protocol, such
`as the source IP address, destination IP address, a checksum, and the length of the packet.
`The header is followed by a data portion that includes a fragment of the higher‐level
`protocol transmission. In this example, the data portion of each IP message contains a
`portion (or piece) of the original Skype message.
`
`At this point, the original Skype message has been fragmented and encapsulated into
`multiple IP messages. Stated differently, the layer 7 message has been encapsulated into a
`set of layer 3 messages.
`
`11
`
`NOAC Ex. 1036 Page 12
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 13 of 25 PageID #: 1835
`
`Each of these layer 3 IP messages may be further encapsulated into one or more Ethernet
`messages (or packets). The Ethernet packets will have a header with Ethernet‐specific
`information, while the data portion will contain the pieces of data that comprise the IP
`message.
`
`The original Skype message may get encapsulated several times. For example, it may get
`encapsulated within IP messages and then again within Ethernet messages. In this
`example, the layer 7 Skype messages have been encapsulated into a set of layer 3 IP
`messages, each of which are encapsulated into a set of layer 1 Ethernet messages.
`
`At this point, the Ethernet packets are placed directly on the wire for transmission.
`
`12
`
`NOAC Ex. 1036 Page 13
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 14 of 25 PageID #: 1836
`
`User 2's computer will then begin receiving the Ethernet messages and the messages will
`be unpacked and re‐combined to form the original Skype message.
`
`It will first combine the Ethernet messages to create the IP messages. During this process,
`the headers of the Ethernet packets are removed and the data portions are concatenated
`to form an IP message.
`
`Then, it will combine the IP messages to create the final Skype message, which is processed
`by the Skype application.
`
`To summarize, the receiving computer receives a sequence of layer 1 messages, which are
`combined into a sequence of layer 3 messages, which are then combined into a single
`layer 7 message. This example generally demonstrates how protocol layering works in
`networked communications.
`
`13
`
`NOAC Ex. 1036 Page 14
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 15 of 25 PageID #: 1837
`
`Conversational Flows will now be described.
`
`14
`
`NOAC Ex. 1036 Page 15
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 16 of 25 PageID #: 1838
`
`Conventional network monitors categorized network transmissions into "connection
`flows." A connection flow corresponds to the packets transmitted by a first computer to a
`second computer in a single connection. A connection is typically characterized by a tuple
`that includes the source IP address, destination IP address, source TCP port, and
`destination TCP port. Thus, a connection flow correlates to source and destination device
`addresses, that is the IP address and port used on both ends of the connection. Shown
`above are three different connections. The sequence of packets going through each
`respective connection is the connection flow.
`
`15
`
`NOAC Ex. 1036 Page 16
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 17 of 25 PageID #: 1839
`
`The network monitor disclosed in the Packet Intelligence patents categorize network
`transmissions into "conversational flows." Unlike connection flows, which relate to a
`negotiated transmission between specific addresses on two devices, conversational flows
`relate to application‐level activity, which may include multiple connections or transmissions
`in either direction between the participants in the conversation. Shown here are three
`different conversational flows, each one corresponding to an activity.
`
`16
`
`NOAC Ex. 1036 Page 17
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 18 of 25 PageID #: 1840
`
`Some of the differences between connection flows and conversational flows can be
`illustrated through our Skype call example. During the Skype call, the Skype application may
`use multiple connections to facilitate the call. For example, it may use a connection for
`sending control information, a connection for sending audio data, and a connection for
`sending video data.
`
`17
`
`NOAC Ex. 1036 Page 18
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 19 of 25 PageID #: 1841
`
`Each of these connections maps to a separate connection flow because each connection
`uses a different address and port for the source and destination. However, all of these
`connections are part of the same conversational flow because all of the connections
`facilitate the application‐level activity of making a Skype call.
`
`18
`
`NOAC Ex. 1036 Page 19
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 20 of 25 PageID #: 1842
`
`The operation of the Network Flow Monitor will now be described. This general description
`reveals the manner in which packets are parsed and analyzed in the preferred
`embodiment.
`
`19
`
`NOAC Ex. 1036 Page 20
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 21 of 25 PageID #: 1843
`
`Figure 3 of the Patents in Suit provides a high‐level overview of the how the claimed
`network monitors operate. The monitors include three stages of operation: 1) Initialization;
`2) Parsing; and 3) Analysis. In general, the initialization stage creates databases that are
`used by both the Parser and the Analyzer modules subsystems. The Parser Subsystem
`parses incoming packets and extracts information from the packet that is used during the
`categorization process. The Analyzer Subsystem takes the information extracted by the
`parser and uses that to determine whether the packet belongs to an existing conversational
`flow or indicates a new conversational flow. The Analyzer is also responsible for
`maintaining the state of conversational flows and determining when a flow has arrived at
`its final classification.
`
`20
`
`NOAC Ex. 1036 Page 21
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 22 of 25 PageID #: 1844
`
`The initialization process builds databases that are used by the network monitor. In the
`preferred embodiment, there are two databases that are generated: (1) the pattern, parse,
`and extraction database; and (2) the state processor instruction database.
`
`The first database, the pattern parse and extraction database, is used by the Parser
`Subsystem. And the second database, the state processor instruction database, is used by
`the Analyzer Subsystem.
`
`As shown in Figure 3, a compiler and optimizer generates data for those two databases.
`According to one embodiment, the compiler and optimizer uses a set of protocol
`description language files (or PDL files) to generate this data.
`
`21
`
`NOAC Ex. 1036 Page 22
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 23 of 25 PageID #: 1845
`
`The parser performs the first stage of packet processing. The parser accepts an incoming
`packet from the packet buffer. The packet is dissected and processed based on patterns
`found within the packet. The parser also extracts certain data from the packet and places
`this in a parser record. Additionally, the parser uses the extracted information to create a
`flow key that helps identify the flow to which this packet belongs. In the preferred
`embodiment, this key is included in the parser record, which is then passed to the Analyzer
`subsystem.
`
`22
`
`NOAC Ex. 1036 Page 23
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 24 of 25 PageID #: 1846
`
`The Analyzer uses the information provided by the Parser Subsystem to perform a
`lookup to determine if this packet belongs to a new or existing flow. If the packet
`belongs to an existing flow, the Analyzer determines whether further processing is
`required for that existing flow. If so, the Analyzer performs further analysis on the
`packet and updates the flow record.
`
`If the packet belongs to a new flow, then no flow record will exist in the flow
`database. The Analyzer then uses the extracted information along with the State
`Processor Instruction Database to determine the protocols used within the packet.
`The Analyzer also identifies the states of the new flow. Once the protocol and state
`have been identified, the Analyzer performs any state processing operations and
`creates a new flow record for the flow.
`
`Once the flow record has been identified or created, the Analyzer updates statistics
`in the flow record based on the received packet.
`
`23
`
`NOAC Ex. 1036 Page 24
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 25 of 25 PageID #: 1847
`
`This concludes the technology tutorial presented by Packet Intelligence.
`
`24
`
`NOAC Ex. 1036 Page 25
`
`