Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 1 of 25 PageID #: 1823
`
`EXHIBIT G
`
`EX 1066 Page 1
`
`
`
`EXHIBIT G
`
`EX 1066 Page 1
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 2 of 25 PageID #: 1824
`
`This presentation is accompanied by a voice-over. If you cannot hear the narrator’s
`voice at this time, please adjust your computer’s audio settings.
`
`1
`
`EX 1066 Page 2
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 3 of 25 PageID #: 1825
`
`•
`
`Packet
`Intelligence
`
`••••••••
`
`Plaintiff Packet Intelligence presents this tutorial to familiarize the Court with the
`technology of the patents in suit.
`
`2
`
`EX 1066 Page 3
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 4 of 25 PageID #: 1826
`
`The Network Monitoring Patents in Suit
`
`Provisional Application
`No. &0/141,909
`
`The patents‐in‐suit are all related and claim priority to the same provisional application.
`The ‘099, ‘725, ‘646, and ‘751 patent all were filed on the same day, June 30, 2000. The
`‘789 patent was filed as a Continuation application to the ‘099 patent.
`
`3
`
`EX 1066 Page 4
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 5 of 25 PageID #: 1827
`
`Network Monitoring
`
`10
`
`FIG.1
`
`FIELD OF INVENTION
`
`The patents‐in‐suit relate to a network monitor that analyzes network communications.
`According to the patents, the monitor determines two things. First, the network monitor
`determines the underlying protocols used within a network communication. Second, the
`monitor uses the identified protocols and data transmitted within those protocols to
`determine the application responsible for the communication.
`
`The packets are analyzed as they pass through a connection point on a computer network.
`As the packets are received, they are analyzed to determine the underlying protocols and
`ultimately the application related to the communication. This process may involve
`analyzing multiple packets before the related protocols and applications are determined.
`
`4
`
`EX 1066 Page 5
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 6 of 25 PageID #: 1828
`
`technol~p Bac.,Ound
`
`A brief explanation of certain background concepts related to the patents‐in‐suit will now
`be provided.
`
`5
`
`EX 1066 Page 6
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 7 of 25 PageID #: 1829
`
`Skype Application
`Uses Proprietary Skype Protocol
`
`Consider users in separate locations making a Skype call to each other via their computers.
`Each location is using the Skype application, and this application uses a proprietary Skype
`protocol to handle the communication. Thus, on detection of the Skype protocol, the
`network monitor can identify the application responsible for the transmission as Skype.
`
`Note that the Skype application is different from the Skype protocol. The application makes
`use of the protocol to communicate.
`
`6
`
`EX 1066 Page 7
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 8 of 25 PageID #: 1830
`
`A Skype transmission from User 1 to User 2, however, must be processed by other
`components and/or devices before it arrives at User 2. These other components and/or
`devices handle lower‐level network communications that are required for User 1's
`computer to talk to User 2's computer. Each protocol participating in this transmission is
`typically correlated with a particular layer in a layered networking model.
`
`7
`
`EX 1066 Page 8
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 9 of 25 PageID #: 1831
`
`The Seven Protocol Layers of OSI
`(Open Systems Interconnection model)
`
`The Open Systems Interconnection model (OSI) is a model of the protocol layers often used
`in network communication. This model was developed as part of a project at the
`International Standards Organization, and it contains the seven layers shown here.
`
`The Application Layer, or layer 7, is the highest level layer. The Physical Layer, or
`layer 1, is the lowest level layer.
`
`These layers provide a model for describing common formats used in network
`communication. Not all network communications use each layer contained in the
`model.
`
`8
`
`EX 1066 Page 9
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 10 of 25 PageID #: 1832
`
`Skype Application
`
`Web Browsing
`
`Applications -H1TP Protocol
`
`~
`
`Skype Protocol
`
`Each layer serves a particular purpose within the network communication model.
`Throughout the following discussion, we will refer to a subset of the OSI layers to illustrate
`networking concepts. However, these concepts are applicable to each layer used within a
`network communication.
`
`The Application layer (or layer 7) represents the application protocol being used in a
`network communication. This is typically the protocol that the user's application is using to
`communicate.
`
`For instance, the Skype protocol is used by Skype applications, and the HTTP protocol is
`used by web browsers.
`
`The Network layer (or layer 3) includes protocols such as the Internet Protocol, also known
`as IP, that are used to support network routing decisions that guide traffic through the
`Internet.
`
`The Physical layer (or layer 1) includes protocols such as Ethernet, that control the
`transmission of raw data onto the wire.
`
`9
`
`EX 1066 Page 10
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 11 of 25 PageID #: 1833
`
`Encapsulating Data
`
`t11 l Application ------
`
`(5) ~;
`
`'4' 11
`t'I
`.~
`
`··.
`
`Protocol layering is accomplished by encapsulation, which is taking a higher level protocol
`message and packaging it up into one or more lower‐level protocol messages. Several
`layers, or protocols, may be involved in a network communication.
`
`Let’s demonstrate the concept of encapsulation by continuing with our Skype example. For
`this example, we will only discuss layers 7, 3, and 1. However, the concepts described
`typically apply to each layer used within a network communication.
`
`10
`
`EX 1066 Page 11
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 12 of 25 PageID #: 1834
`
`0SU.ayer7
`Application Layer
`
`Shown here is a Skype message that is being sent from User 1's computer in Los Angeles to
`User 2's computer. This message is written in an application layer protocol, the Skype
`protocol. This is IOS layer 7. Prior to transmission, it is broken into one or more IP
`messages (or packets) that are written in the IP protocol. The IP protocol layer is layer 3.
`Each of these IP packets includes a header with information specific to the IP protocol, such
`as the source IP address, destination IP address, a checksum, and the length of the packet.
`The header is followed by a data portion that includes a fragment of the higher‐level
`protocol transmission. In this example, the data portion of each IP message contains a
`portion (or piece) of the original Skype message.
`
`At this point, the original Skype message has been fragmented and encapsulated into
`multiple IP messages. Stated differently, the layer 7 message has been encapsulated into a
`set of layer 3 messages.
`
`11
`
`EX 1066 Page 12
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 13 of 25 PageID #: 1835
`
`0SU.ayer7
`Application Layer
`
`Each of these layer 3 IP messages may be further encapsulated into one or more Ethernet
`messages (or packets). The Ethernet packets will have a header with Ethernet‐specific
`information, while the data portion will contain the pieces of data that comprise the IP
`message.
`
`The original Skype message may get encapsulated several times. For example, it may get
`encapsulated within IP messages and then again within Ethernet messages. In this
`example, the layer 7 Skype messages have been encapsulated into a set of layer 3 IP
`messages, each of which are encapsulated into a set of layer 1 Ethernet messages.
`
`At this point, the Ethernet packets are placed directly on the wire for transmission.
`
`12
`
`EX 1066 Page 13
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 14 of 25 PageID #: 1836
`
`I Application I.ayer
`
`User 2's computer will then begin receiving the Ethernet messages and the messages will
`be unpacked and re‐combined to form the original Skype message.
`
`It will first combine the Ethernet messages to create the IP messages. During this process,
`the headers of the Ethernet packets are removed and the data portions are concatenated
`to form an IP message.
`
`Then, it will combine the IP messages to create the final Skype message, which is processed
`by the Skype application.
`
`To summarize, the receiving computer receives a sequence of layer 1 messages, which are
`combined into a sequence of layer 3 messages, which are then combined into a single
`layer 7 message. This example generally demonstrates how protocol layering works in
`networked communications.
`
`13
`
`EX 1066 Page 14
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 15 of 25 PageID #: 1837
`
`conversational Flows;
`
`Conversational Flows will now be described.
`
`14
`
`EX 1066 Page 15
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 16 of 25 PageID #: 1838
`
`Conventional Connedion Flows
`
`Conventional network monitors categorized network transmissions into "connection
`flows." A connection flow corresponds to the packets transmitted by a first computer to a
`second computer in a single connection. A connection is typically characterized by a tuple
`that includes the source IP address, destination IP address, source TCP port, and
`destination TCP port. Thus, a connection flow correlates to source and destination device
`addresses, that is the IP address and port used on both ends of the connection. Shown
`above are three different connections. The sequence of packets going through each
`respective connection is the connection flow.
`
`15
`
`EX 1066 Page 16
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 17 of 25 PageID #: 1839
`
`Conversational Flows
`
`The network monitor disclosed in the Packet Intelligence patents categorize network
`transmissions into "conversational flows." Unlike connection flows, which relate to a
`negotiated transmission between specific addresses on two devices, conversational flows
`relate to application‐level activity, which may include multiple connections or transmissions
`in either direction between the participants in the conversation. Shown here are three
`different conversational flows, each one corresponding to an activity.
`
`16
`
`EX 1066 Page 17
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 18 of 25 PageID #: 1840
`
`Skype Call With
`Multiple Connedion Flows
`
`Some of the differences between connection flows and conversational flows can be
`illustrated through our Skype call example. During the Skype call, the Skype application may
`use multiple connections to facilitate the call. For example, it may use a connection for
`sending control information, a connection for sending audio data, and a connection for
`sending video data.
`
`17
`
`EX 1066 Page 18
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 19 of 25 PageID #: 1841
`
`All Connections Part of
`One Conversational Flow
`
`Each of these connections maps to a separate connection flow because each connection
`uses a different address and port for the source and destination. However, all of these
`connections are part of the same conversational flow because all of the connections
`facilitate the application‐level activity of making a Skype call.
`
`18
`
`EX 1066 Page 19
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 20 of 25 PageID #: 1842
`
`Qperatlon.of the.Ratented. ·Network:Menltor
`
`The operation of the Network Flow Monitor will now be described. This general description
`reveals the manner in which packets are parsed and analyzed in the preferred
`embodiment.
`
`19
`
`EX 1066 Page 20
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 21 of 25 PageID #: 1843
`
`Figure 3 of the Patents in Suit provides a high‐level overview of the how the claimed
`network monitors operate. The monitors include three stages of operation: 1) Initialization;
`2) Parsing; and 3) Analysis. In general, the initialization stage creates databases that are
`used by both the Parser and the Analyzer modules subsystems. The Parser Subsystem
`parses incoming packets and extracts information from the packet that is used during the
`categorization process. The Analyzer Subsystem takes the information extracted by the
`parser and uses that to determine whether the packet belongs to an existing conversational
`flow or indicates a new conversational flow. The Analyzer is also responsible for
`maintaining the state of conversational flows and determining when a flow has arrived at
`its final classification.
`
`20
`
`EX 1066 Page 21
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 22 of 25 PageID #: 1844
`
`Initialization
`
`FIG. 3
`
`The initialization process builds databases that are used by the network monitor. In the
`preferred embodiment, there are two databases that are generated: (1) the pattern, parse,
`and extraction database; and (2) the state processor instruction database.
`
`The first database, the pattern parse and extraction database, is used by the Parser
`Subsystem. And the second database, the state processor instruction database, is used by
`the Analyzer Subsystem.
`
`As shown in Figure 3, a compiler and optimizer generates data for those two databases.
`According to one embodiment, the compiler and optimizer uses a set of protocol
`description language files (or PDL files) to generate this data.
`
`21
`
`EX 1066 Page 22
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 23 of 25 PageID #: 1845
`
`Parser
`
`•
`
`The parser performs the first stage of packet processing. The parser accepts an incoming
`packet from the packet buffer. The packet is dissected and processed based on patterns
`found within the packet. The parser also extracts certain data from the packet and places
`this in a parser record. Additionally, the parser uses the extracted information to create a
`flow key that helps identify the flow to which this packet belongs. In the preferred
`embodiment, this key is included in the parser record, which is then passed to the Analyzer
`subsystem.
`
`22
`
`EX 1066 Page 23
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 24 of 25 PageID #: 1846
`
`Analyzer
`
`The Analyzer uses the information provided by the Parser Subsystem to perform a
`lookup to determine if this packet belongs to a new or existing flow. If the packet
`belongs to an existing flow, the Analyzer determines whether further processing is
`required for that existing flow. If so, the Analyzer performs further analysis on the
`packet and updates the flow record.
`
`If the packet belongs to a new flow, then no flow record will exist in the flow
`database. The Analyzer then uses the extracted information along with the State
`Processor Instruction Database to determine the protocols used within the packet.
`The Analyzer also identifies the states of the new flow. Once the protocol and state
`have been identified, the Analyzer performs any state processing operations and
`creates a new flow record for the flow.
`
`Once the flow record has been identified or created, the Analyzer updates statistics
`in the flow record based on the received packet.
`
`23
`
`EX 1066 Page 24
`
`
`
`Case 2:16-cv-00230-JRG Document 55-21 Filed 01/20/17 Page 25 of 25 PageID #: 1847
`
`•
`
`Packet
`Intelligence
`
`••••••••
`
`This concludes the technology tutorial presented by Packet Intelligence.
`
`24
`
`EX 1066 Page 25
`
`
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ Charge
Still Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site
