United States Patent (19)
`Anderson et al.
`
`54 PROTOCOL ANALYZER FOR MONITORING
`DIGITAL TRANSMISSION NETWORKS
`
`75 Inventors: Craig D. Anderson, Durham; Mark B.
`
`Anderson, Chapel Hill; Eugene N.
`Cookmeyer, Apex; Ralph A. Daniels,
`Clayton; Lee E. Wheat, Durham;
`Roger A. Lingle, Raleigh, all of N.C.
`
`73 Assignee: Wandel & Goltermann Technologies,
`Inc.
`
`USOO585.0388A
`Patent Number:
`11
`(45) Date of Patent:
`
`5,850,388
`Dec. 15, 1998
`
`5,293,384 3/1994 Keeley et al. ......................... 371/16.3
`5,303,344 4/1994 Yokoyama et al. .
`395/200
`5,309,507 5/1994 Hosaka et al.......
`... 379/96
`5,317,725 5/1994 Smith et al. ............................ 395/575
`
`3. RC El - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - E.
`5.333.302 7
`CIIl . . . . . . . . . . .
`2- - -2
`/1994 Hensley et al
`5,345,396 9/1994 Yamaguchi .
`5,347,524 9/1994 IAnson ...
`5,373,346 12/1994 Hocker .....
`5,375,126 12/1994 Wallace ...
`5,375,159 12/1994 Williams ...
`5,377,196 12/1994 Godlew et al. .
`
`395/575
`... 395/500
`371/29.1
`... 364/550
`371/20.1
`... 379/23
`371/20.1
`
`21 Appl. No.: 742,093
`
`5,418,972 5/1995 Takeuchi et al. - - - - - - - - - - - - - - - - - - - - - - - 395/800
`
`22 Filed:
`
`Oct. 31, 1996
`
`Related U.S. Application Data
`60 Provisional application No. 60/023,459, Aug. 2, 1996.
`6
`
`.370,252.37.1.20.lost
`E. Fi la f s - - - - - - - - h - - - - - - -
`/252;
`/
`2. 252
`e
`O eaCl . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
`s
`s
`370/253; 371/20.1; 395/183.15, 200.94
`References Cited
`
`56)
`
`U.S. PATENT DOCUMENTS
`4,437,184 3/1984 Cork et al. ................................ 371/19
`4,550,407 10/1985 Couasnon et al. ........................ 371/29
`4,672,611 6/1987 Fukuhara et al. ......................... 37 so
`4,680,755
`7/1987 Reames ..................................... 370/85
`4,775,973 10/1988 Tomberlin et al. ....................... ...
`4,792,753 12/1988 Iwai
`324/73
`4.887.260 12/1989 Carden et al...
`... 370,60
`4,916,694 4/1990 Roth .......................................... 370/94
`5,040,111
`8/1991 Al-Salameth et al.
`... 364/200
`5,090,014 2/1992 Polich et al.......
`... 371/15.1
`
`(List continued on next page.)
`OTHER PUBLICATIONS
`Uyless Black, “OSI: A Model for Computer Communica
`tions Standards”, Prentice-Hall, Inc., pp. 8-11 and 54-56,
`1991.
`Weaver, Alfred C. and McNabb, James F., “A Real-Time
`Monitor for Token Ring Networks,” MILCOM 89: Bridg
`ing the Gap, pp. 794-798, 1989.
`Brochure, Network General Corporation, Products and Ser
`vices, dated May, 1995, face, back page, and pp. 1-10.
`Primary Examiner Melvin Marcelo
`Attorney, Agent, or Firm Moore & Van Allen, PLLC;
`William G. Dosse
`ABSTRACT
`57
`A new and improved protocol analyzer for monitoring
`digital transmission networks is disclosed. The protocol
`analyzer of the present invention is capable of displaying
`Station level Statistics, network Statistics, real-time event
`information, and protocol distribution. The protocol ana
`lyZer of the present invention is additionally capable of
`
`5,097.469 3/1992 Douglas. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 371/20.1
`
`creating baseline network performance information and dis
`
`playing the baseline information simultaneously with real
`5,187,708 2/1993 Nakatani et al. ...................... 370/85.1
`5.
`3/1993 Wylie al.
`- - - 358 time performance information, pre-programming monitor
`'12. WiNR al. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . sf4. ing Sessions, and generating presentation-quality reports in
`5,276.802
`1/1994 Yamaguchi et al...... so,
`conjunction with analyzing digital transmission networks,
`5,278,836
`1/1994 Iimura et al. ........................... 370,112
`all in real time.
`5,282,194
`1/1994 Harley, Jr. et al. ....................... 370/17
`5,287,506 2/1994 Whiteside ............................... 395/650
`1 Claim, 18 Drawing Sheets
`
`301
`
`Network Frames
`
`Protocol
`Analyzer
`Instrument
`
`
`
`
`
`
`
`
`
`Direct
`aCCeSS
`storage
`
`Packet Intelligence LLC Exh 2074
`Juniper Networks, Inc., et al v. Packet Intelligence LLC
`IPR2020-00337
`Page 1 of 36
`
`

`

`5,850,388
`Page 2
`
`U.S. PATENT DOCUMENTS
`
`OTHER PUBLICATIONS
`
`7/1995 Miller ........................................ 370/13
`5,434,845
`5,440,719 8/1995 Hanes et al.
`395/500
`5,442,737 8/1995 Smith .............
`395/135
`5,442,741 8/1995 Hughes et al. .
`... 395/142
`5,444,706 8/1995 Osaki ................
`... 370/94.1
`5,446,874 8/1995 Waclawski et al.
`395/575
`5,457.729 10/1995 Hamann et al. ...................... 379/2
`5,469,463 11/1995 Polich et al. ...
`95/182.18
`5,473,551 12/1995 Sato et al...
`... 364/496
`5,475,732 12/1995 Pester, III ................................. 379/34
`5,477,531 12/1995 McKee et al. ............................ 370/17
`5,481,548
`1/1996 Wallace ......
`371/20.1
`5,490,199 2/1996 Fuller et al. ................................ 379/1
`5,504,736 4/1996 Cubbison, Jr. .
`... 370/13
`5,701,400 12/1997 Amado ...................................... 395/76
`
`
`
`Distributed Sniffer System, “Seven-Layer Analysis on all
`Segments. Quickly Pinpoints Problems And Recommends
`Solutions”, Network General Corporation, dated May, 1996,
`6 pages.
`Sniffer Network Analyzer, “Seven-Layer Analysis on all
`Segments Quickly Pinpoints Problems And Recommends
`Solutions'. Network General Corporation, dated Jul. 1996
`s
`p
`s
`s
`6 pages.
`Product Brochure, DominoLANTM Internetwork Analyzer,
`DA-320, Wandel & Goltermann, 6 pages.
`User Guide, Link ViewTM 1000 Network Analyzer, Tinwald
`Networking Technologies Inc., dated Jan. 1, 1996.
`
`Packet Intelligence LLC Exh 2074
`Juniper Networks, Inc., et al v. Packet Intelligence LLC
`IPR2020-00337
`Page 2 of 36
`
`

`

`U.S. Patent
`
`Dec. 15, 1998
`
`Sheet 1 of 18
`
`5,850,388
`
`F.G. 1
`
`
`
`LAYER 7 - APPLICATION LAYER
`LAYER 6 - PRESENTATION LAYER
`LAYER 5 - SESSION LAYER
`LAYER4 - TRANSPORT LAYER
`LAYER3 - NETWORKLAYER
`LAYER2 - DATALINK LAYER
`LAYER 1 - PHYSICAL LAYER
`
`FIG. 2
`
`208
`PREAMBLE
`Bytes: 8
`
`209
`210
`211
`212
`213
`DESTINATIONSOURCETYPE
`DATA
`FCS
`6
`6
`2
`46-1500
`4.
`k-64-1518 Bytes
`"Frame Length"
`
`Packet Intelligence LLC Exh 2074
`Juniper Networks, Inc., et al v. Packet Intelligence LLC
`IPR2020-00337
`Page 3 of 36
`
`

`

`U.S. Patent
`
`5,850,388
`
`
`
`
`
`
`
`
`
`
`
`9. "?INH
`
`[09]
`
`Packet Intelligence LLC Exh 2074
`Juniper Networks, Inc., et al v. Packet Intelligence LLC
`IPR2020-00337
`Page 4 of 36
`
`

`

`U.S. Patent
`
`Dec. 15, 1998
`
`Sheet 3 of 18
`
`5,850,388
`
`FIG. 4
`
`413
`
`Add the frame length
`Add 1 to the frames
`to the bytes
`transmitted field of "Ef
`the entry for the
`ry
`Source Address in
`Source Address in
`the Station List Array
`the Station List Arra
`
`414
`
`415
`
`
`
`Update the Error
`Statistics Subarray
`frame length
`of the entry for the
`1518 bytes-Yes
`Source Address in
`the Station List Array
`to reflect a jabber
`
`ls the
`frame length
`S. 64 bytes2
`
`
`
`
`
`ls the frame
`byte-aligned?
`
`
`
`s
`the FCS
`of the frame
`Orrect2
`
`
`
`Update the Error
`Statistics Subarray
`Yes of the entry for the
`Source Address in
`the Station List Array
`to reflect a runt
`
`Update the Error
`19 Statistics Subarray
`of the entry for the
`Source Address in
`the Station List Array
`to reflect an
`alignment error
`
`Update the Error
`Statistics Subarray
`of the entry for the
`Source Address in
`the Station List Array
`to reflect an FCS
`eO
`
`423
`
`402
`
`network frame
`
`Get
`Get Source
`Destination
`Address from frie
`frame
`405
`Get FCS
`from frame
`
`Determine the
`Frame Length
`
`
`
`407
`
`an entry for the
`Destination Address in
`the Station List
`
`Add an entry for the
`Destination Address to the
`Station List Arra
`
`Received field of the entry for
`the Destination Address in
`the Station List Arra
`409
`Add the Frame Length to the
`Bytes Received field of the
`entry for the Destination Address
`in the Station List Arra
`410
`
`411
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`an entry for the Source
`Address in the Station
`
`Yes
`
`
`
`NO
`
`412
`
`Add an entry for the Source
`Address to the Station List Array
`
`Packet Intelligence LLC Exh 2074
`Juniper Networks, Inc., et al v. Packet Intelligence LLC
`IPR2020-00337
`Page 5 of 36
`
`

`

`U.S. Patent
`
`Dec. 15, 1998
`
`Sheet 4 of 18
`
`5,850,388
`
`FIG. 5
`
`protocol
`id
`
`
`
`
`
`
`
`
`
`
`
`statistics
`for the
`protocol
`
`
`
`
`
`position
`
`505
`
`children table
`protocol
`array
`id
`position
`
`501
`
`502
`
`503
`
`506
`
`507
`
`F.G. 6
`
`
`
`601
`
`602 - PROTOCOL DISTRIBUTION
`
`
`
`Packet Intelligence LLC Exh 2074
`Juniper Networks, Inc., et al v. Packet Intelligence LLC
`IPR2020-00337
`Page 6 of 36
`
`

`

`U.S. Patent
`
`Dec. 15, 1998
`
`Sheet 5 of 18
`
`5,850,388
`
`701.
`
`70
`
`frame
`
`703
`ldentify first protocol
`
`FIG. 7
`
`704
`
`
`
`present in the
`frame?
`
`
`
`
`
`Store protocol
`information to
`Protocol
`Distribution Array
`
`
`
`protocol
`Conversation
`
`No
`
`Identify next
`protocol by
`comparing bit
`sequences to
`possible next
`protocols
`
`Use "next layer
`identification field" &
`lookup table to
`identify next
`protocol present in
`frame
`
`
`
`
`
`
`
`No
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`710
`
`711
`
`
`
`Has the
`sampling period
`expired?
`
`Yes
`Reset sampling period
`statistics for the protocol
`
`
`
`as networ
`monitoring session
`ended?
`
`Yes
`
`712
`
`Packet Intelligence LLC Exh 2074
`Juniper Networks, Inc., et al v. Packet Intelligence LLC
`IPR2020-00337
`Page 7 of 36
`
`

`

`U.S. Patent
`
`Dec. 15, 1998
`
`Sheet 6 of 18
`
`5,850,388
`
`FIG. 8
`
`FIG. 9
`
`No
`
`801
`
`802
`
`803
`
`804
`
`
`
`
`
`805
`
`
`
`
`
`
`
`
`
`Detect network
`frame
`
`Hardware
`o COUnter
`increments
`
`
`
`Has the
`sampling period
`expired?
`
`Yes
`et Count O
`network frames
`from hardware
`Counter
`
`806
`
`901
`
`902
`
`903
`
`
`
`904
`
`
`
`905
`
`
`
`906
`
`o
`Analyzer receives
`network frame
`
`aCWale
`COUnter
`increments
`
`NO
`
`Has the
`sampling period
`expired?
`
`
`
`Yes
`et COunt O
`analyzer frames
`from hardware
`Counter
`
`Packet Intelligence LLC Exh 2074
`Juniper Networks, Inc., et al v. Packet Intelligence LLC
`IPR2020-00337
`Page 8 of 36
`
`

`

`U.S. Patent
`
`Dec. 15, 1998
`Sheet 7 of 18
`FIG 10
`
`5,850,388
`
`1101
`
`1102
`
`1103
`
`1104
`
`FIG 11
`
`PORTION OF EVENT
`LOG ARRAY
`(NEW ENTRIES SINCE
`LAST UPDATE)
`
`FIG. 12
`
`
`
`1201 -
`
`1202-
`
`
`
`1301 -
`
`130
`
`NETWORK
`STATISTICS ARRAY
`
`Packet Intelligence LLC Exh 2074
`Juniper Networks, Inc., et al v. Packet Intelligence LLC
`IPR2020-00337
`Page 9 of 36
`
`

`

`U.S. Patent
`
`Dec. 15, 1998
`
`Sheet 8 of 18
`
`5,850,388
`
`FIG. 13
`
`Embedded Code
`
`NetWork
`information
`
`Pointer to Updated 1401
`NetWork info
`
`Update------
`Requests
`C & Aa
`OranOS
`
`Pointer to Updated
`NetWork info for
`Real Time Display
`
`User
`interface
`
`1404
`
`303
`
`302
`
`- - - - - - -N
`NetWork
`Information
`
`
`
`1402
`
`(Database ()
`
`
`
`1403
`
`Baseline
`Data
`
`Packet Intelligence LLC Exh 2074
`Juniper Networks, Inc., et al v. Packet Intelligence LLC
`IPR2020-00337
`Page 10 of 36
`
`

`

`U.S. Patent
`
`Dec. 15, 1998
`
`Sheet 9 of 18
`
`5,850,388
`
`FIG. 14
`
`4. Decode Message
`
`
`
`302
`
`
`
`
`
`
`
`
`
`Station-Level
`Statistics
`Target
`
`3. Initialization
`
`
`
`
`
`
`
`5. Store
`Station-Level
`Statistics
`
`2. Receive
`Update
`
`Embedded
`COde
`
`
`
`6. Inform Document
`f
`of Receipt of Update
`
`
`
`1402 1. Request
`Update
`
`Station-Level
`Statistics
`Database
`Class
`
`
`
`
`
`
`
`
`
`1502
`
`7. Inform View
`of Receipt of Update
`
`
`
`9. Verify New
`Data
`
`
`
`11. Get
`Data
`
`8. Inform 10.
`View of Verify 12. Get
`Receipt of New Data
`Update Data
`
`
`
`
`
`1504
`
`
`
`Station
`Details
`View
`
`13. Present
`Data
`
`14. Present
`Data
`
`Packet Intelligence LLC Exh 2074
`Juniper Networks, Inc., et al v. Packet Intelligence LLC
`IPR2020-00337
`Page 11 of 36
`
`

`

`U.S. Patent
`
`Dec. 15, 1998
`
`Sheet 10 0f 18
`
`5,850,388
`
`F.G. 15
`
`4. DeCode Message
`
`
`
`302
`
`
`
`
`
`
`
`
`
`
`
`NetWork
`Statistics
`Target
`
`1601
`
`5. Store Network
`Statistics
`
`3. Initialization
`
`2. Receive
`Update
`
`6. Inform Document
`of Receipt of Update
`
`Embedded
`Code
`
`
`
`
`
`1402 1. Request
`Update
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`NetWork
`Statistics
`Database
`Class
`
`1602
`
`7A. Inform View
`of Receipt of Update
`
`8A. Verify New
`Data
`
`
`
`
`
`9A. Get
`Data
`
`8B.
`7B.
`9B.
`Verify
`Inform
`View of New Get
`Receipt Data Data
`of Update
`p
`
`
`
`
`
`Network
`Statistics
`Chart
`View
`
`1604
`
`Network
`Statistics
`Table
`View
`
`1 OA. Present
`Data
`
`1 OB. Present
`Data
`
`Packet Intelligence LLC Exh 2074
`Juniper Networks, Inc., et al v. Packet Intelligence LLC
`IPR2020-00337
`Page 12 of 36
`
`

`

`U.S. Patent
`
`Dec. 15, 1998
`
`Sheet 11 of 18
`
`5,850,388
`
`F.G. 16
`
`4. Decode Message
`
`
`
`302
`
`
`
`
`
`
`
`
`
`Protocol
`Distribution
`(Cumulative)
`Target
`
`2. Receive
`Update
`
`1701
`
`6. Inform Document
`of Receipt of Update
`
`Embedded
`Code
`
`
`
`5. Store Protocol
`3. Initializatio
`Distribution
`
`1402 1. Request
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`Protocol
`Distribution
`Database
`Class
`
`
`
`
`
`1702
`
`
`
`7. Inform View
`of Receipt of Update
`
`
`
`8. Verify New
`
`
`
`1704
`
`
`
`
`
`
`
`10. Inform
`View
`of Receipt
`of Update
`
`Protocol
`Distribution
`Tree
`View
`
`12. Present
`Data
`
`
`
`11. Get
`Data
`
`Protocol
`Distribution
`Chart
`View
`
`13. Present
`Data
`
`Packet Intelligence LLC Exh 2074
`Juniper Networks, Inc., et al v. Packet Intelligence LLC
`IPR2020-00337
`Page 13 of 36
`
`

`

`U.S. Patent
`
`Dec. 15, 1998
`
`Sheet 12 of 18
`
`5,850,388
`
`FG, 17
`
`4. Decode Message
`
`
`
`302
`
`
`
`
`
`2. Receive
`Update
`
`6. Inform Document
`of Receipt of Update
`
`3. Initialization
`
`5. Store Event
`Information
`
`
`
`
`
`Event Log
`Database
`Class
`
`
`
`
`
`1802
`
`Embedded
`Code
`
`
`
`1402
`
`1. Request
`Update
`
`7. Inform View of
`Receipt of Update
`
`
`
`8. Verify New
`Data
`
`9. Get
`Data
`
`
`
`1803
`
`10. Present
`Data
`
`Packet Intelligence LLC Exh 2074
`Juniper Networks, Inc., et al v. Packet Intelligence LLC
`IPR2020-00337
`Page 14 of 36
`
`

`

`U.S. Patent
`
`Dec. 15, 1998
`
`Sheet 13 of 18
`
`5,850,388
`
`
`
`s
`
`
`
`
`
`
`
`
`
`N
`X ON coco O NO OO CN CO WCON OO
`OO
`V
`H CONN NP V - ON IN CON (f) OOOOO CNO OO
`O IO IO) CNOO WCO w COLO cr) CNCO w O CO CO CO
`8NSS CY) w
`O). OON COLO w () (NON ON CN
`99 Studio N. N.
`v w
`O >LO w
`S4
`v
`o
`;
`;
`;
`;
`;
`;
`;
`;
`;
`;
`;
`;
`;
`38 :
`;
`SSSSSSSSSSSS
`U 5 CSCs
`O C COO O. O. O. O. O. O. r O
`OO
`O 5 OOO O O O OOOOOOOOOOO
`cocoods sees
`OO
`oessleese?
`SRSS2S2S282 v.
`
`;
`
`;
`
`;
`
`;
`
`O
`
`
`
`O
`
`
`
`Packet Intelligence LLC Exh 2074
`Juniper Networks, Inc., et al v. Packet Intelligence LLC
`IPR2020-00337
`Page 15 of 36
`
`

`

`U.S. Patent
`
`Dec. 15, 1998
`
`Sheet 14 of 18
`
`5,850,388
`
`
`
`S NYN N N N N N N Y N
`
`C
`9. wu
`(VS
`N
`
`D
`S4
`
`h Š CD
`
`2
`
`l l N
`l
`l l
`l l
`l
`l
`Spod oo N. co Lo v coc Y - d
`
`i
`
`Packet Intelligence LLC Exh 2074
`Juniper Networks, Inc., et al v. Packet Intelligence LLC
`IPR2020-00337
`Page 16 of 36
`
`

`

`Packet Intelligence LLC Exh 2074
`Juniper Networks, Inc., et al v. Packet Intelligence LLC
`IPR2020-00337
`Page 17 of 36
`
`

`

`U.S. Patent
`
`Dec. 15, 1998
`
`Sheet 16 of 18
`
`5,850,388
`
`
`
`22 1.
`? í í 2 0
`2
`| D | | | T |
`
`NS
`M N N N N N N N N N
`
`
`
`UIO!!110!!!SIG 34S 9 LUBIE
`
`Packet Intelligence LLC Exh 2074
`Juniper Networks, Inc., et al v. Packet Intelligence LLC
`IPR2020-00337
`Page 18 of 36
`
`

`

`U.S. Patent
`
`
`
`5,850,388
`
`
`
`
`
`(IleaON) BIH DJ d\/S [] (IleaON) SOIG?ºN DJ
`
`0Z “?IH
`
`
`
`
`
`000060°C) :(liêAON) dI}} :
`
`
`ZOOO$9'98 OTT [H+]
`
`Packet Intelligence LLC Exh 2074
`Juniper Networks, Inc., et al v. Packet Intelligence LLC
`IPR2020-00337
`Page 19 of 36
`
`

`

`Packet Intelligence LLC Exh 2074
`Juniper Networks, Inc., et al v. Packet Intelligence LLC
`IPR2020-00337
`Page 20 of 36
`
`

`

`1
`PROTOCOLANALYZER FOR MONITORING
`DIGITAL TRANSMISSION NETWORKS
`
`This application claims priority to provisional applica
`tion number 60/023,459, filed Aug. 2, 1996.
`FIELD OF THE INVENTION
`The present invention relates generally to the field of
`computer and data communications networks and Systems
`and more particularly to protocol analyzers for monitoring
`and analyzing digital transmission networkS.
`BACKGROUND OF THE INVENTION
`Wide area computer networks (“WANs”) first emerged in
`the 1970s to enable computers to communicate across
`broad geographic areas. Distributed computing resources,
`Such as personal computers, WorkStations, Servers and
`printers, have proliferated in recent years due to the declin
`ing cost and increasing performance of computer hardware.
`This has been a key factor in the growth of local area
`network technology. Local area networks (“LANs”) allow
`increased productivity and utilization of distributed comput
`erS or Stations through the Sharing of resources, the transfer
`of information and the processing of data at the most
`efficient locations. AS organizations have recognized the
`economic benefits of using LANS, network applications
`Such as electronic mail, file transfer, host acceSS and shared
`databases have been developed as means to increase user
`productivity. This increased Sophistication, together with the
`growing number of distributed computing resources, has
`resulted in a rapid expansion in the number of installed
`LANS.
`As the demand for LANs has grown, LAN technology has
`expanded and now includes many different physical con
`nection configurations (“network topologies” or
`“networks”), such as Ethernet, a LAN that employs a bus
`topology where the computing resources are connected to a
`Single cable, Token Ring, a LAN that employs a ring
`topology where the computing resources are connected to a
`single closed loop cable; and Fiber Distributed Data Inter
`face (“FDDI”), a LAN that supports fiber optic cables where
`the computing resources are connected in a Series of dual
`rings. These and the many other types of networks that have
`appeared typically have Several different cabling Systems,
`utilize different bandwidths and transmit data at different
`Speeds. In addition, hardware and Software Systems for
`LANs usually have different sets of rules and standards
`(“protocols”) which define the method of access to the
`network and communication among the resources on the
`network, such as Novell NetWare, IBM NetBIOS, DECNet,
`AppleTalk and Banyan Vines. More recently, large users of
`LANs have increasingly Sought to integrate local area net
`works with WANs, and this trend is expected to intensify as
`inter-network technology advances So as to permit more
`rapid delivery of advanced multimedia communications
`utilizing Asynchronous Transfer Mode ("ATM"), an
`advanced high-Speed Switching protocol, and other broad
`band transmission technologies.
`Digital data are usually transmitted over a network in
`frames (also referred to as “data frames” or “packets”) which
`can be of fixed or variable length depending upon the
`number of bits in the data portion of the frame. Frames
`usually have headers (e.g., addresses) and footers on the two
`ends of the frame, with the conveyed data bits being in the
`middle. These headers and footers are also Sometimes
`referred to as “protocols.” The structure of a frame is
`
`5
`
`15
`
`25
`
`35
`
`40
`
`45
`
`50
`
`55
`
`60
`
`65
`
`5,850,388
`
`2
`discussed in more detail below in the section entitled Frame
`Analysis. The nature and content of the headers and footers
`are usually dictated by the type of network.
`Transmissions from one network computer to another
`must be passed through a hierarchy of protocol layers. Each
`layer in one network computer carries on a conversation
`with the corresponding layer in another computer with
`which communication is taking place, in accordance with a
`protocol defining the rules of communication. In reality,
`information is transferred down from layer to layer in one
`computer, then through the communication channel medium
`and back up the Successive layers in the other computer. To
`facilitate understanding, however, it is easier to consider
`each of the layers as communicating with its counterpart at
`the same level, in a horizontal direction.
`The hierarchy of network layers is illustrated in FIG. 1.
`The highest network layer is the Application Layer 7. It is
`the level through which user applications access network
`services. The Presentation Layer 6 translates data from the
`Application Layer 7 into an intermediate format and pro
`vides data encryption and compression Services. The Ses
`Sion Layer 5 allows two applications on different computers
`to communicate by establishing a dialog control between the
`two computers that regulates which side transmits, when
`each side transmits, and for how long. The Transport Layer
`4 is responsible for error recognition and recovery, repack
`aging of long messages into Small packages of information,
`and providing an acknowledgment of receipt. The Network
`Layer 3 addresses messages, determines the route along the
`network from the Source to the destination computer, and
`manages traffic problems, Such as Switching, routing, and
`controlling the congestion of data transmissions. The Data
`Link Layer 2 packages raw bits into logical structured
`packets or frames. It then Sends the frame from one com
`puter to another. If the destination computer does not Send
`an acknowledgment of receipt, the Data Link Layer 2 will
`resend the frame. The Physical Layer 1 is responsible for
`transmitting bits from one computer to another by regulating
`the transmission of a Stream of bits over a physical medium.
`This layer defines how the cable is attached to the network
`interface card within the Station computer and what trans
`mission technique is used to Send data over the cable. As a
`message is passed down through the layers, each layer may
`or may not add protocol information to the message.
`AS LANs and WANs have increased in number and
`complexity, networks have become more likely to develop
`problems which, in turn, have become more difficult to
`diagnose and Solve. Network performance can Suffer due to
`a variety of causes, Such as the transmission of unnecessarily
`Small frames of information, inefficient or incorrect routing
`of information, improper network configurations and Super
`fluous network traffic. Specific network hardware and soft
`ware Systems may also contain design flaws which affect
`network performance or limit access by users to certain of
`the resources on the network. These problems are com
`pounded by the fact that most local and wide area networks
`are continually changing and evolving due to growth, recon
`figuration and the introduction of new network topologies,
`protocols, interconnection devices and Software applica
`tions.
`Increasing numbers of organizations use local and wide
`area networks, and the accurate and timely transmission and
`processing of information on LANs and WANs have become
`Vital to the performance of many businesses. Mission
`critical applications, Such as telemarketing, order-entry, air
`line reservation Systems and bank electronic funds transfer
`systems, now reside on LANs and WANs. The financial
`
`Packet Intelligence LLC Exh 2074
`Juniper Networks, Inc., et al v. Packet Intelligence LLC
`IPR2020-00337
`Page 21 of 36
`
`

`

`3
`consequences of network problems that adversely affect
`these applications can be enormous. Without network analy
`sis products which identify how and where data are moving
`on local and wide area networks, users of these networks
`have no means to effectively analyze and monitor perfor
`mance or to isolate problems for prompt resolution.
`Network analyzers monitor the digital traffic orbit stream
`So as to identify and examine principally the headers and
`footers of each frame in order to analyze the health of the
`digital network. Hence, they are often called network pro
`tocol analyzers. The period of time during which a network
`is being analyzed is referred to as a "network monitoring
`Session.” Typically, protocol analyzers are designed to
`identify, analyze and resolve interoperability and perfor
`mance problems across the principal configurations of LAN
`15
`and WAN topologies and protocols.
`The protocol analyzers enable computer network users to
`perform a wide variety of network analysis tasks, Such as
`counting errors, filtering frames, generating traffic and trig
`gering alarms. There are many examples of digital network
`transmission protocol analyzer instruments. One Such
`example is shown in U.S. Pat. No. 4,792,753, granted to
`Iwai on Dec. 20, 1988. Another digital network transmission
`protocol analyzer, directed particularly to Token Ring
`networks, collects Several types of information about a
`network, including Statistics, events, and network attributes
`by analyzing Sequences of control frame transmissions and
`is shown in U.S. Pat. No. 5,097,469, granted to Douglas on
`Mar. 17, 1992. Many of the protocol analyzer instruments
`are combined with user interfaces having display and key
`board and/or other input capability. The generation and
`display of certain message traffic characteristics are
`addressed in U.S. Pat. No. 3,826,908, granted in July 1974
`to Weathers et al. U.S. Pat. No. 4,775,973, granted to
`Toberlin, et al., on Oct. 4, 1988, discloses a method and
`apparatus for monitoring protocol portions of digital net
`work transmissions and displaying a matrix of traffic from
`transmitting Stations and to destination Stations. U.S. Pat.
`No. 5,375,126 granted to Wallace on Dec. 20, 1994, dis
`closes a System for testing digital data telecommunication
`networks, with display of fault analysis, comparative View
`ing of fault-free benchmark data and with provision to offer
`Suggestions as to probable causes of faults. In the network
`communications monitor of U.S. Pat. No. 5,442,639,
`granted on Aug. 15, 1995, to Crowder et al., selected frames
`may be captured in a capture buffer, Stored electronically,
`and/or displayed in real time. U.S. Pat. No. 5,487,073,
`granted to Urien on Jan. 23, 1996, discloses commanding a
`communications coupler to perform a Set of network func
`tion tests. The network Status results of the tests are Sent to
`a data-processing unit for display.
`Protocol analyzers are produced in two general types. One
`is larger, leSS portable and more comprehensive in the Scope
`of tests which it can perform. This type is used primarily by
`developerS and manufacturers of network Systems. The
`other type is Smaller, more portable, and often easier to
`operate and lower-priced, albeit often with Some limitations
`as to the Scope of its testing capability. This latter type of
`protocol analyzer is produced primarily for field Service
`technicians who maintain computer network Systems.
`A protocol analyzer's monitoring, diagnostic and problem
`resolution activities are usually under Software control. Such
`Software control is exercised by a main central processing
`unit (CPU), which is usually one or more microprocessors
`contained within the protocol analyzer itself. The protocol
`analyzer may also utilize a separate computer controller,
`Such as a "laptop,” to facilitate human interface.
`
`65
`
`45
`
`50
`
`55
`
`60
`
`5,850,388
`
`25
`
`35
`
`40
`
`4
`To Some degree, the Software which protocol analyzers
`use may be characterized as expert System Software which
`facilitates isolation of problems on a network being ana
`lyzed. This expert System Software may be contained in the
`protocol analyzers internal memory or in the Separate
`computer controller. The utility, efficiency,
`comprehensiveness, and ease of use of a protocol analyzer,
`particularly one designed for use by a field technician, is in
`large part directly proportional to the corresponding capa
`bilities of the Software in the protocol analyzer and even in
`its computer controller.
`Current protocol analyzers for use by field technicians
`have numerous limitations. One Such limitation is the inabil
`ity to analyze and display comprehensive network transmis
`Sion information in real-time (as the transmissions occur).
`When analysis of network transmissions must be done
`off-line, the likelihood that an important network occurrence
`or “event” will be missed is significantly increased.
`In addition, current protocol analyzers do not present
`network transmission information in Sufficiently meaningful
`or detailed ways, nor do they allow for on-line comparison
`of current network performance to prior network perfor
`mance. For example, it would be useful if more meaningful
`displays of the numerous types of Statistics related to the
`network as a whole or just a given Station on the network
`were available to the user in juxtaposition with other infor
`mation. Also, many users would like to see complicated
`information and detailed protocol distribution Statistics dis
`played in a manner that is easier to use and easier visually
`to understand. Display to the user of more detailed infor
`mation about anomalies or “events' that occur on the System
`would be useful to a user, especially if displayed in a more
`usable form and in “real time’ and accumulated over a
`network monitoring Session. Certainly, conveniently
`displayed troubleShooting assistance would be helpful, as
`would visual reporting in “real time' and accumulated over
`an analysis Session. Off-line analysis of Selected frames
`captured during a network monitoring Session could be more
`conveniently displayed to the user.
`Finally, while protocol analyzers of the prior art provide
`reasonable diagnostic capability, they do not guide the field
`technician through event analysis and the appropriate Solu
`tions. In general, these limitations combine to prevent effec
`tive guidance to the field technician in actually analyzing
`and Solving the network problem.
`SUMMARY OF THE INVENTION
`It is an object of the present invention to provide a new
`and improved protocol analyzer capable of displaying Sta
`tion level Statistics, displaying real time event detection,
`creating baseline network performance information and
`comparing Said baseline information with real-time perfor
`mance information and displaying to a user the results of that
`comparison, pre-programming monitoring Sessions, gener
`ating reports in conjunction with analyzing digital transmis
`Sion networks, all in real time.
`In accordance with one embodiment of the present
`invention, the operation of a protocol analyzer includes one
`or more of the following: monitoring, in real time, the
`transmission of data packets having protocol portions and
`data portions, identifying the protocol portions of Said
`packets in real time; analyzing, in real time, the protocol
`portions of Said packets to ascertain relevant information;
`Storing Said information to a database in real time, Sorting
`Said information in real time, according to Station level
`parameters, Statistically analyzing Said Sorted information in
`
`Packet Intelligence LLC Exh 2074
`Juniper Networks, Inc., et al v. Packet Intelligence LLC
`IPR2020-00337
`Page 22 of 36
`
`

`

`S
`real time to obtain Statistical information; displaying Said
`Statistical information in real-time reports, displaying Said
`Statistical information in report formats Selected by an
`operator, displaying real time performance of the network
`Simultaneously with baseline network performance, Simul
`taneously displaying Statistical information gathered from a
`plurality of protocol analyzer instruments, pre-programming
`the monitoring of the transmission of data packets wherein
`the operator may select the duration of the network moni
`toring Session; monitoring in real time one or more Selected
`and assorted network parameters and comparing the results
`of said analysis with arbitrary threshold values for said
`parameters to determine if the transmission on the network
`is exceeding Said threshold So as to constitute an event;
`analyzing in real time Said Sorted information to calculate
`the probabilities of the possible causes of Said ascertained
`events, and displaying in real time the one or more possible
`causes of Said event.
`It is another object of the present invention to analyze and
`meaningfully display the Statistics of the occurrence and
`distribution of protocols encapsulated within the Several
`levels of the Several data frames analyzed by a protocol
`analyzer instrument.
`In accordance with another embodiment of the present
`invention, the operation of a protocol analyzer includes one
`or more of the following: monitoring, in real time, the
`transmission of data packets having protocol portions and
`data portions, identifying the protocol portions of Said
`packets in real time; analyzing, in real time, the protocol
`portions of