computing, based at least partially upon the set of behavioralstatistics, a badness factor
`
`for the flow, wherein the badness factor provides an indication of whether the flow is
`
`exhibiting undesirable behavior.
`
`6. (Original) The method of claim 5, wherein the badness factor also provides an indication of
`
`a degree to whichthe flow is behaving undesirably.
`
`7. (Original) The methodof claim 6, further comprising:
`
`determining, basedat lcast partially upon the badness factor, a penalty to impose on the
`
`flow.
`
`8. (Original) The method of claim 7, further comprising: enforcing the penalty on the flow.
`
`9, (Original) The method of claim 8, wherein enforcing the penalty on the flow causesthe flow
`
`to exhibit less undesirable behavior, thereby, causing the badnessfactor of the flow to improve.
`
`10. (Original) The method of claim 8, whercin the penalty is enforecd on the flow when a
`
`congestion condition is encountered.
`
`11. (Original) The method of claim 8, wherein no penalty is enforced on the flowunless a
`
`congestion condition is encountered, regardless of howundesirably the flow is behaving.
`
`12. (Original) The method of claim 8, wherein the penalty is determined and enforced on the
`
`flow even when no congestion condition is encountered.
`
`13. (Original) The method of claim 8, wherein determming the penalty comprises:
`
`determining an increased drop rate to impose on one or more information packets
`
`belonging to the flow.
`
`14. (Original) The methodof claim 13, wherein enforcing the penalty comprises:
`
`SABLE-01008
`
`Response to Final Office Action
`
`21
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 145
`
`Splunk Inc. Exhibit 1002 Page 145
`
`

`

`imposing the increased drop rate on the flow such that the information packets belonging
`
`to the flow have a higherprobability of being dropped than information packcts
`
`belonging to other flows that do not exhibit undesirable behavior.
`
`15. (Original) The method of claim 5, wherein the set of behavioral statistics comprises a
`
`measure T of how muchtotal information has been contained tnall of theformation packets
`
`belonging to the flow that have been forwarded up to a current point in time.
`
`16. (Original) The method of claim 5, whercin the sct of bchavioral statistics comprises a
`
`measure L of how long the flow has been in existence up to a current pointin time.
`
`17. (Original) The method of claim 16, wherein the set of behavioral statistics comprises a rate
`
`R of information transfer for the flow, wherein R is derived by dividing T by L.
`
`18. (Original) The methodof claim 5, wherein the set of behavioralstatistics comprises an
`
`average size for the information packets belonging to the flow.
`
`19, (Original) The method ofclaim 5, wherein maintaining the set of behavioralstatistics
`
`comprises:
`
`receiving a particular information packet belonging to the flow;
`
`determining whether to forward the particular information packet to a destination; and
`
`in response to a determination to forward the particular information packet to the
`
`destination, updating the set of behavioralstatistics to reflect processing of the particular
`
`information packet.
`
`20. (Original) The method of claim 5, wherein maintaining the set of behavioralstatistics
`
`comprises:
`
`receiving a particular information packet belonging to the flow; and
`
`SABLE-01008
`
`Response to Final Office Action
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 146
`
`Splunk Inc. Exhibit 1002 Page 146
`
`

`

`updating the set of behavioral statistics to reflect processing of the particular information
`
`packet, regardless of whether the particular information packet is discarded or forwarded
`
`to a destination.
`
`21. (Original) A misbehaving flow manager (MFM)for processing a flow, the flow comprising
`
`a series of information packets, the MFM comprising:
`
`means for maintaining a set of behavioral statistics for the flow, wherein the set of
`
`behavioralstatistics arc updated as information packcts belonging to the flow arc
`
`processed;
`
`meansfor determining, based at least partially upon the set of behavioralstatistics,
`
`whether the flowis exhibiting undesirable behavior; and
`
`meansfor enforcing, in response to a determination that the flow is exhibiting undesirable
`
`behavior, a penalty on the flow.
`
`22. (Original) The MFM ofclaim 21, wherein enforcing the penalty has an effect of correcting
`
`the flow's behavior such that the flow exhibits less undesirable behavior.
`
`23. (Original) The MFM of claim 21, wherein the means for enforcing the penalty comprises:
`
`means for imposing an increased drop rate on the flow such that the information packets
`
`belonging to the flow have a higher probability of being dropped than information
`
`packets belonging to other flows that do not exhibit undesirable behavior.
`
`24. (Original) The MFM ofclaim 21, wherein the penalty is enforced when a congestion
`
`condition is encountered.
`
`25. (Original) A misbehaving flow manager (MFM)for processing a flow, the flow comprising
`
`a series of information packets, the MFM comprising:
`
`SABLE-01008
`
`Response to Final Office Action
`
`23
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 147
`
`Splunk Inc. Exhibit 1002 Page 147
`
`

`

`means for maintaining a set of behavioral statistics for the flow, wherein the set of
`
`behavioralstatistics arc updated as information packcts belonging to the flow arc
`
`processed; and
`
`means for computing, based at least partially upon the set of behavioralstatistics, a
`
`badness factor for the flow, wherein the badness factor provides an indication of whether
`
`the flowis exhibiting undesirable behavior.
`
`26. (Original) The MFM of claim 25, wherein the badnessfactor also provides an indication of a
`
`degree to whichthe flow is behaving undesirably.
`
`27. (Original) The MFM ofclaim 26, further comprising:
`
`means for determining, based at least partially upon the badness factor, a penalty to
`
`imposeonthe flow.
`
`28. (Original) The MFM of claim 27, further comprising: means for cnforcing the penalty on the
`
`flow.
`
`29. (Original) The MFM ofclaim 28, wherein enforcing the penalty on the flow causes the flow
`
`to exhibit less undesirable behavior, thereby, causing the badness factor of the flow to improve.
`
`30. (Original) The MFM of claim 28, wherein the penalty is enforced on the flow when a
`
`congestion condition is encountered.
`
`31. (Original) The MFM of claim 28, wherein no penalty is enforced on the flow unless a
`
`congestion condition is encountered, regardless of howundesirably the flow is behaving.
`
`32. (Original) The MFM of claim 28, wherein the penalty is determined and enforced on the
`
`flow even when no congestion condition is encountered.
`
`33. (Original) The MFM of claim 28, wherein the means for determining the penalty comprises:
`
`SABLE-01008
`
`Response to Final Office Action
`
`24
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 148
`
`Splunk Inc. Exhibit 1002 Page 148
`
`

`

`means for determining an increased drop rate to Impose on one or more information
`
`packets belonging to the flow.
`
`34. (Original) The MFM ofclaim 33, wherein the means for enforcing the penalty comprises:
`
`meansfor imposing the increased drop rate on the flow such that the information packets
`
`belonging to the flow have a higher probability of bemg dropped than information
`
`packets belongingto other flows that do not exhibit undesirable behavior.
`
`35. (Original) The MFM of claim 25, wherein the sct of bchavioralstatistics compriscs a
`
`measure T of how muchtotal information has been contaimed in all of the information packets
`
`belonging to the flow that have been forwarded up to a current point in time.
`
`36. (Original) The MFM of claim 25, wherein the set of behavioral statistics comprises a
`
`measure L of how long the flow has been in existence up to a current point in time.
`
`37. (Original) The MFM of claim 36, wherein the sct of bchavioral statistics comprises a rate R
`
`of information transfer for the flow, wherein R is derived by dividing T by L.
`
`38. (Original) The MFM ofclaim 25, wherein the set of behavioral statistics comprises an
`
`average size for the information packets belonging to the flow.
`
`39. (Original) The MFM of claim 25, wherein the means for maintaiming the set of behavioral
`
`statistics compriscs:
`
`means for receiving a particular information packet belonging to the flow;
`
`meansfor determining whether to forward the particular information packet to a
`
`destination; and
`
`means for updating, in response to a determination to forwardthe particular information
`
`packet to the destination, the set of behavioralstatistics to reflect processing of the
`
`particular information packet.
`
`SABLE-01008
`
`Response to Final Office Action
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 149
`
`Splunk Inc. Exhibit 1002 Page 149
`
`

`

`40. (Original) The MFM ofclaim 25, wherein the means for maintaining the set of behavioral
`
`statistics compriscs:
`
`means for recerving a particular information packet belonging to the flow; and
`
`meansfor updating the set of behavioral statistics to reflect processing ofthe particular
`
`information packet, regardless of whether the particular information packet 1s discarded
`
`or forwarded to a destination.
`
`41. (New)
`
`A machine-implemented method for processing a single flow, the flow
`
`comprising a plurality of packets, and the method comprising:
`
`creating a flow blockasthe first packet of a flow is processed by a single router;
`
`said flow block being configured to store payload-content-agnostic behavioral statistics
`
`pertaining to said flow;
`
`said router updating said flow block with the payload-content-agnostic behavioral
`
`statistics as packets belonging to said flow are processed by said router;
`
`said router heuristically determining whether said flowexhibits undesirable behavior by
`
`comparing at least one of said payload-content-agnostic behavioralstatistics to at least
`
`one pre-determined threshold value; and
`
`upon determination by said router that said flow cxhibits undesirable behavior, enforcing,
`
`relative to at least one packet, a penalty;
`
`wherein said payload-content-agnostic behavioralstatistics for said flow are calculated by
`
`said router without requiring use of inter-router data.
`
`42. (New)
`
`A computer-readable medium having computer-executable instructions for
`
`performing a method to process a single flow, the flow comprising a plurality of packets, and the
`
`method comprising:
`
`SABLE-01008
`
`Response to Final Office Action
`
`26
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 150
`
`Splunk Inc. Exhibit 1002 Page 150
`
`

`

`creating a flowblock as the first packet of a flow is processed by a single router;
`
`said flow block being configured to store payload-content agnostic behavioral statistics
`
`about said flow;
`
`said router updating said flow block with the flow’s behavioral statistics as packets
`
`belonging to said flow are processed by said router;
`
`said router heuristically determining whether said flowis exhibiting undesirable behavior
`
`by comparing at lcast one of said behavioral statistics to at least one pre-determined
`
`threshold value; and
`
`upon determination by said router that said flow is exhibiting undesirable behavior,
`
`enforcing, relative to at least one packet belonging to said flow, a penalty;
`
`wherein said behavioral statistics for said flow are calculated by said router and
`
`independentof inter-router data.
`
`43. (New)
`
`Anarticle of manufacture comprising:
`
`a computer-readable medium having stored thereon a data structure;
`
`a first field containing data representing a flowblock;
`
`a second field containing data representing payload-content-agnostic behavioralstatistics
`
`about a flow;
`
`a third field contaming data representing pre-determined behavior threshold values;
`
`a fourth field containing data representing the results of a heuristic determination of
`
`whether said flow exhibits undesirable behavior determined by comparing said
`
`behavioral statistics to said pre-determined threshold values;
`
`a fifth field containing data representing at least one penalty to be enforced against at
`
`least one packet upon determinationthat said flow exhibits undesirable behavior.
`
`SABLE-01008
`
`Response to Final Office Action
`
`27
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 151
`
`Splunk Inc. Exhibit 1002 Page 151
`
`

`

`The “Highest Number Previously Paid For” (Total or Independent) is the highest numberfoundin the appropriate box in column 1.
`
`NA
`
`ba
`
`_T,
`/
`minus 20 =
`J
`-
`minus 3 =
`If the specification and drawings exceed 100
`sheets of paper, the application size fee due
`is $250 ($125 for small entity) for each
`additional 50 sheets orfraction thereof. See
`35 U.S.C. 41(a)(1)(G) and 37 CFR 1.16(s).
`
`Cl MULTIPLE DEPENDENTCLAIM PRESENT(37 CFR1.16(j))
`* If the difference in column 1 is less than zero, enter “O” in column 2.
`
`APPLICATION AS AMENDED - PARTII
`
`(Column 1)
`CLAIMS
`REMAINING
`AFTER
`AMENDMENT
`
`(Column 2)
`HIGHEST
`NUMBER
`PREVIOUSLY
`PAID FOR
`
`(Column 3)
`
`PRESENT
`EXTRA
`
`04/13/2010
`
`ADDITIONAL
`FEE($)
`
`OTHER THAN
`SMALL ENTITY
`
`ADDITIONAL
`FEE ($)
`
`[_] application Size Fee (37 CFR 1.16(s))
`
`CT] FIRST PRESENTATION OF MULTIPLE DEPENDENTCLAIM (37 CFR 1.16(j))
`
`kK
`Zz
`uu
`
`=aZ A
`
`2
`M
`
`(Column 3)
`
`(Column 1)
`(Column 2)
`CLAIMS
`HIGHEST
`
`
`REMAINING RATE (6)|ADDITIONALNUMBER PRESENT ADDITIONAL
`
`
`AFTER
`PREVIOUSLY
`EXTRA
`FEE ($)
`FEE ($)
`AMENDMENT
`PAID FOR
`7
`Zz
`Total (37 cFR
`.
`a eee virusT=
`A
`=
`Gq1Ll Application size Fee (37 CFR 1.16(s))
`=<<
`CT FIRST PRESENTATION OF MULTIPLE DEPENDENTCLAIM (37 CFR 1.16(j))
`a
`
`=
`
`is less than the entry in column 2, write “0” in column 3.
`* lf the entry in column 1
`** If the “Highest Number Previously Paid For’ IN THIS SPACEis less than 20, enter “20”.
`*** If the “Highest Number Previously Paid For’ IN THIS SPACEis less than 3, enter “3”.
`
`Legal Instrument Examiner:
`/BRENDA WEBB/
`
`This collection of information is required by 37 CFR 1.16. The information is required to obtain or retain a benefit by the public which is to file (and by the USPTO to
`process) an application. Confidentiality is governed by 35 U.S.C. 122 and 37 CFR 1.14. This collection is estimated to take 12 minutes to complete, including gathering,
`preparing, and submitting the completed application form to the USPTO. Timewill vary depending uponthe individual case. Any comments on the amountof time you
`require to complete this form and/or suggestions for reducing this burden, should be sent to the Chief Information Officer, U.S. Patent and Trademark Office, U.S.
`Department of Commerce, P.O. Box 1450, Alexandria, VA 22313-1450. DO NOT SEND FEES OR COMPLETED FORMS TO THIS
`ADDRESS. SEND TO: Commissionerfor Patents, P.O. Box 1450, Alexandria, VA 22313-1450.
`{f you need assistance in completing the form, call 1-800-PTO-9199 and select option 2.
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 152
`
`PTO/SB/06 (07-06)
`Approved for use through 1/31/2007. OMB 0651-0032
`U.S. Patent and Trademark Office; U.S. DEPARTMENT OF COMMERCE
`Under the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unlessit displays a valid OMB control number.
`
`PATENT APPLICATION FEE DETERMINATION RECORD|*?Plcation or Docket NumberJFiling Date
`Substitute for Form PTO-875 42/22/2004|C1 To be Mailed11/022,599
`
`
`
`APPLICATION AS FILED — PART|
`OTHER THAN
`
`
`(Column 1) SMALL ENTITY []=oR(Column 2) SMALL ENTITY
`ROGER FLED
`eo Aro]
`FeO
`N/A
`NIA
`
`
`
`N/A
`
`N/A
`
`N/A
`
`N/A
`
`L] Basic FEE
`‘37 CFR 1.16(a),
`
`(b), or (¢
`
`L] SEARCH FEE
`(i). or (m
`37 CER 1.16(k),
`C] EXAMINATION FEE
`(37 CER 1.18(0), (p), or (q))
`TOTAL CLAIMS
`(37 CFR 1.16(i))
`INDEPENDENT CLAIMS
`(37 CFR 1.16(h
`
`oO
`
`Seace SIZE FEE
`(
`-16(s))
`
`Splunk Inc. Exhibit 1002 Page 152
`
`

`

`
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`
`UNITED STATES DEPARTMENT OF COMMERCE
`United States Patent and Trademark Office
`Address: COMMISSIONER F'OR PATENTS
`P.O. Box 1450
`Alexandria, Virginia 22313-1450
`www.uspto.gov
`
`APPLICATION NO.
`
`FILING DATE
`
`FIRST NAMED INVENTOR
`
`ATTORNEY DOCKET NO.
`
`CONFIRMATION NO.
`
`11/022,599
`
`12/22/2004
`
`Vishnu Natchu
`
`SABLE-01008
`
`8956
`
`08/19/2010
`7596
`43490
`WIST & ASSOCIATES, A PC
`1255 Treat Blvd.
`3rd Floor
`WALNUT CREEK, CA 94597
`
`p
`
`
`
`WONG, XAVIER S$
`
`2462,
`
`innit
`
`NOTIFICATION DATE
`
`DELIVERY MODE
`
`08/19/2010
`
`ELECTRONIC
`
`Please find below and/or attached an Office communication concerning this application or proceeding.
`
`The time period for reply, if any, is set in the attached communication.
`
`Notice of the Office communication was sent electronically on above-indicated "Notification Date” to the
`following e-mail address(es):
`PATENT @WEST-ASSOCIATES.NET
`STWEST @ ASTOUND.NET
`PATENT @ WESTPATENTLAW.COM
`
`PTOL-90A (Rev. 04/07)
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 153
`
`Splunk Inc. Exhibit 1002 Page 153
`
`

`

`
`
`Office Action Summary
`
`Application No.
`
`Applicant(s)
`
`11/022,599
`Examiner
`
`XavierSzewai Wong
`
`NATCHU, VISHNU
`Art Unit
`
`2462 |
`
`-- The MAILING DATEof this communication appears on the cover sheet with the correspondence address--
`Period for Reply
`
`A SHORTENED STATUTORY PERIOD FOR REPLYIS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS,
`WieMENER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION.
`Extensions of time may be available underthe provisions of 37 CFR 1.136(a).
`In no event, however, maya reply betimelyfiled
`after SIX (6) MONTHSfrom the mailing date of this communication.
`-
`If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHSfrom the mailing date of this communication.
`- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133).
`Anyreply received by the Office later than three monthsafter the mailing date of this communication, evenif timely filed, may reduce any
`eared patent term adjustment. See 37 CFR 1.704(b).
`
`Status
`
`1)X] Responsive to communication(s) filed on 13" April 2010.
`2a)L] This action is FINAL.
`2b)X] This action is non-final.
`3)L] Sincethis application is in condition for allowance except for formal matters, prosecution as to the merits is
`closed in accordancewith the practice under Ex parte Quayle, 1935 C.D. 11, 453 O.G. 213.
`
`Disposition of Claims
`
`4)X] Claim(s) 1-43 is/are pendingin the application.
`4a) Of the above claim(s)____ is/are withdrawn from consideration.
`5)L] Claim(s)
`is/are allowed.
`6) Claim(s) 1-43 is/are rejected.
`7) Claim(s)___ is/are objected to.
`8)L] Claim(s)__ are subject to restriction and/or election requirement.
`
`Application Papers
`
`9)L] The specification is objected to by the Examiner.
`10)L] The drawing(s)filed on
`is/are: a)[_] accepted or b)_] objected to by the Examiner.
`Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a).
`
`Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d).
`11)C The oath ordeclaration is objected to by the Examiner. Note the attached Office Action or form PTO-152.
`
`Priority under 35 U.S.C. § 119
`
`12) Acknowledgmentis made of a claim for foreign priority under 35 U.S.C. § 119(a)}(d) or(f).
`a)LJAI b)L] Some*c)] None of:
`
`1.L] Certified copies of the priority documents have been received.
`2.1] Certified copies of the priority documents have been received in Application No.
`3.0] Copiesofthe certified copies of the priority documents have beenreceived in this National Stage
`application from the International Bureau (PCT Rule 17.2(a)).
`* See the attached detailed Office action for a list of the certified copies not received.
`
`
`
`Attachment(s)
`1) Xl Notice of References Cited (PTO-892)
`2) CJ Notice of Draftsperson’s Patent Drawing Review (PTO-948)
`3) [J Information Disclosure Statement(s) (PTO/SB/08)
`Paper No(s)/Mail Date
`;
`U.S. Patent and Trademark Office
`PTOL-326 (Rev. 08-06)
`
`4) Cl Interview Summary (PTO-413)
`Paper No(s)/Mail Date. __
`5) L] Notice of Informal Patent Application
`6) CT Other:
`
`Office Action Summary
`
`Part of Paper No./Mail Date 20100813
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 154
`
`Splunk Inc. Exhibit 1002 Page 154
`
`

`

`Application/Control Number: 11/022,599
`Art Unit: 2462
`
`Page 2
`
`DETAILED ACTION
`
`Continued Examination Under 37 CFR 1.114
`
`A request for continued examination under 37 CFR 1.114, including the fee set
`
`forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this
`
`application is eligible for continued examination under 37 CFR 1.114, and the fee set
`
`forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action
`
`has been withdrawn pursuant to 37 CFR 1.114. Applicant’s submission filed on 13"
`
`April 2010 has been entered.
`
`Response to Arguments
`
`Argumentsfiled on 13'" April 2010 have been considered but are mootin view of
`
`new groundsof rejections. Jacobson et al teaches a method for processing one flow at
`
`a time based on information from only that one flow (remarks pg. 12); see rejection
`
`below.
`
`Nonetheless, the examiner maintains disagreement that Zikan et al cannot be
`
`modified to teach “one flow” processing since Zikan et al clearly states “an overall flow
`
`in a particular arc typically is a [conglomeration] Of ONE [ox more separate] flow(s),” in other
`
`words, the arc flow can be one single flow (emphasis added). Such (each one/single) arc
`
`flow is governed by a penalty and merit function Eq.s(f) as explained in col. 10 lines 29-
`
`30.
`
`Claim Rejections - 35 USC § 107
`
`35 U.S.C. 101 reads as follows:
`
`Whoever invents or discovers any new and useful process, machine, manufacture, or composition of
`matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the
`conditions and requirements ofthis title.
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 155
`
`Splunk Inc. Exhibit 1002 Page 155
`
`

`

`Application/Control Number: 11/022,599
`Art Unit: 2462
`
`Page 3
`
`Claims 42 and 43 are directed to non-statutory subject matter. The “computer-
`
`readable medium” may be “an optical medium (e.g. an optical fiber), a coaxial cable, or
`
`some other type of medium. For purposesof the present invention, network 100 may
`
`use any type of transport medium,” which may comprise of both transitory and non-
`
`transitory medium as indicated on page 6 paragraph 0017 of the applicant’s
`
`specification. It must be made clear that the invention is claiming a -- Non-Transitory --
`
`computer-readable medium in orderfor the claims to be statutory.
`
`Claim Rejections - 35 USC § 102
`
`The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that
`
`form the basis for the rejections under this section made in this Office action:
`
`A person shall be entitled to a patent unless —
`
`(e) the invention was described in (1) an application for patent, published under section 122(b), by
`another filed in the United States before the invention by the applicant for patent or (2) a patent
`granted on an application for patent by another filed in the United States before the invention by the
`applicant for patent, except that an international application filed under the treaty defined in section
`351(a) shall have the effects for purposesof this subsection of an application filed in the United States
`only if the international application designated the United States and was published under Article 21(2)
`of such treaty in the English language.
`
`Claims 1, 2, 4-8, 10, 21, 22, 24, 25, 27 — 30, 41 and 42 are rejected under 35
`
`U.S.C. 102(e) as being anticipated by Jacobsonetal (US 2005/0226149 A1).
`
`Consider claims 1 and 21, Jacobsonet al teach a dynamic load balancer (e.g.
`
`MFM) for processing a flow which comprisesof a series of information packets(fig. 1:
`
`gateway 106; abstract: to identify a non-adaptive flow; [0009] lines 13-15: per-flow
`
`basis), the balancer comprising means for: maintaining a set of behavioral statistics,
`
`which are updated as information packets belong to the flow are processed, for the flow
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 156
`
`Splunk Inc. Exhibit 1002 Page 156
`
`

`

`Application/Control Number: 11/022,599
`Art Unit: 2462
`
`Page 4
`
`([0098]: changing parameters... statistical method for a flow); determining, based upon
`
`the behavioral statistics, whether the flow is exhibiting undesirable behavior ([O086]:
`
`detect non-adaptive flow); enforcing, in response to the determination of undesirable
`
`behavior, a penalty on the flow ([0101-0102]: penalty for a flow).
`
`Consider claims 5 and 25, Jacobsonet al disclose a dynamic load balancer(e.g.
`
`MFM) for processing a flow which comprisesof a series of information packets(fig. 1:
`
`gateway 106; abstract: to identify a non-adaptive flow; [0009] lines 13-15: per-flow
`
`basis; [0056]: a series of packets), the balancer comprising means for: maintaining a set
`
`of behavioral statistics, which are updated as information packets belongto the flow are
`
`processed, for the flow ([0098]: changing parameters... statistical method for a flow);
`
`computing, based at least partially upon the set of behavioral statistics, a badness factor
`
`for the flow ([0097]: DEM for a flow), to provide indication of whetherthe flow is
`
`exhibiting undesirable behavior ([0101-0103]: penalty for a flow).
`
`Consider claims 2 and 22, as applied to claims 1 and 21, Jacobsonet al teach
`
`means for the penalty has an effect of correcting the flow’s behavior such that the flow
`
`exhibits less undesirable behavior ([0101]: reduce sending rate for non-adaptive flow).
`
`Consider claims 4, 10, 24 and 30, as applied to claims 1, 8, 21 and 28,
`
`Jacobson etal teach that the invention is to solve, among other misbehaviors/faults,
`
`congestion in a network ([0098]: congestion); the penalty function is enforced when a
`
`misbehavior/fault, such as a congestion, is encountered ([(0100-0103]: penalty).
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 157
`
`Splunk Inc. Exhibit 1002 Page 157
`
`

`

`Application/Control Number: 11/022,599
`Art Unit: 2462
`
`Page 5
`
`Consider claims 6 and 26, as applied to claims 5 and 25, Jacobsonet al teach
`
`the badness factor providing an indication of a degree to whichthe flow is behaving
`
`undesirably ([0097]: DEM for a flow).
`
`Consider claims 7, 8, 27 and 28 as applied to claims 6, 7, 26 and 27, Jacobson
`
`et al teach means for determining, based on the badness factor, a penalty to impose
`
`and enforce on the flow ([0098] lines 15-24).
`
`Consider claims 41 and 42, Jacobsonetal teach a machine-implemented
`
`method for processing a single flow by a computer readable medium having computer-
`
`executable instructions (fig. 1: gateway 106; abstract: to identify a non-adaptive flow;
`
`[0009] lines 13-15: per-flow basis), the flow comprising a plurality of packets ([O056]: a
`
`series of packets) and the method comprising:
`
`creating a flow block as the first packet of a flow is processed by a single router
`
`(fig. 9: flow block 904 in gateway 106);
`
`said flow block being configured to store payload-content-agnostic behavioral
`
`statistics pertaining to said flow ([0095-0097));
`
`said router updating said flow block with the payload-content-agnostic behavioral
`
`statistics as packets belonging to said flow are processed by the router ([0098]:
`
`changing parameters... statistical method for a flow);
`
`said router heuristically determining whether said flow exhibits undesirable
`
`behavior by comparing at least one of said payload-content-agnostic behavioral
`
`statistics to at least one pre-determined threshold value (fig. 2: lower and upper
`
`thresholds; [0098] + claims 4 and 5: comparing DEM ofa flow to a range); and
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 158
`
`Splunk Inc. Exhibit 1002 Page 158
`
`

`

`Application/Control Number: 11/022,599
`Art Unit: 2462
`
`Page 6
`
`upon determination by said router that said flow exhibits undesirable behavior,
`
`enforcing, relative to at least one packet, a penalty ([0101-0103]: penalty);
`
`wherein said payload-content-agnostic behavioral statistics for said flow are
`
`calculated by said router without (independentof) use of inter-router data (fig. 1: only
`
`gateway 106 is used, so there is not other “inter-router” data for gateway 106 to depend
`
`on).
`
`Claim Rejections - 35 USC § 103
`
`The following is a quotation of 35 U.S.C. 103(a) which forms the basis forall
`
`obviousnessrejections set forth in this Office action:
`
`(a) A patent may not be obtained though the invention is not identically disclosed or described as set
`forth in section 102 ofthis title, if the differences between the subject matter sought to be patented and
`the prior art are such that the subject matter as a whole would have been obviousatthe time the
`invention was made to a person having ordinary skill in the art to which said subject matter pertains.
`Patentability shall not be negatived by the manner in which the invention was made.
`
`The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148
`
`USPQ 459 (1966), that are applied for establishing a background for determining
`
`obviousness under 35 U.S.C. 103(a) are summarized asfollows:
`
`=oh
`
`Determining the scope and contents of the prior art.
`Ascertaining the differences between the prior art and the claims at issue.
`Resolving the level of ordinary skill in the pertinent art.
`Considering objective evidence present in the application indicating
`obviousness or nonobviousness.
`
`Claims 3, 12, 13, 14, 18, 23, 32, 33, 34 and 38 are rejected under 35 U.S.C.
`
`103(a) as being unpatentable over Jacobsonetal (US 2005/0226149 A‘) in view of
`
`Skirmont (US 6,252,848 B1).
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 159
`
`Splunk Inc. Exhibit 1002 Page 159
`
`

`

`Application/Control Number: 11/022,599
`Art Unit: 2462
`
`Page 7
`
`Consider claims 3, 13, 14, 23, 33 and 34, as applied to claims 1, 8, 13, 21, 28
`
`and 33, Jacobson et al teach the penalty imposed involve lost packets (Zikan, col. 4 In.
`
`716-20: drop rate). However, Jacobsonet al may not have explicitly mentioned an
`
`increased drop rate such that a misbehaving flow has a higher probability of being
`
`dropped than flows that do not exhibit undesirable misbehavior. Skirmont teaches
`
`means for assigning not well-behaved flows to higher drop probabilities and therefore,
`
`creating an increased droprate, than a flow thatis well-behaved (col. 4 In. 64-67). It
`
`would have been obvious to one of ordinary skill in the art at the time the invention was
`
`created to apply the teachings of Skirmont to the penalty function of Jacobsonetal for
`
`penalty enforcement on misbehaving flows.
`
`Consider claims 12 and 32, as applied to claims 8 and 28, Jacobson et al teach
`
`the claimed invention except may not have explicitly mentioned the penalty is
`
`determined and enforced on the flow even when no congestion condition is
`
`encountered. Skirmont mentions a Random Early Detection (RED) algorithm
`
`comprising means for allowing the dropping of packets without regard to the
`
`characteristics (e.g. congestion) of a flow (col. 5 In. 27-24). It would have been obvious to
`
`one of ordinary skill in the art at the time the invention was created to incorporate the
`
`RED algorithm as mentioned by Skirmont to the load balancer of Jacobsonetal for
`
`improving network flow performance.
`
`Consider claims 18 and 38, as applied to claims 5 and 25, Jacobson et al teach
`
`the claimed invention except may not have explicitly mentioned the behavioral statistics
`
`comprising an average size for the information packets of a flow. Skirmont teachesin
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 160
`
`Splunk Inc. Exhibit 1002 Page 160
`
`

`

`Application/Control Number: 11/022,599
`Art Unit: 2462
`
`Page 8
`
`figure 2 an average queue (flow) size is taken into account when deciding a drop
`
`probability (col. 4 In. 26-34). It would have been obvious to one ofordinary skill in the art
`
`at the time the invention was created to apply the teachings of Skirmont to the penalty
`
`function of Jacobson etal for enforcing flow traffic.
`
`Claims 9 and 29 are rejected under 35 U.S.C. 103(a) as being unpatentable over
`
`Jacobson et al (US 2005/0226149 A1) in view of Zikan et al (US 6,310,881 B1).
`
`Consider claims 9 and 29, as applied to claims 8 and 28, Jacobsonet al teach
`
`means for the penalty has an effect (enforcing) of correcting the flow’s behavior such that
`
`the flow exhibits less undesirable behavior ([0097-0098]: DEM for a flow). Jacobson et
`
`al do not very explicitly teach “causing the badnessfactor to improve.” Zikan et al teach
`
`conceptof causing Ea.,(f) (e.g. badnessfactor) to improve (maximization of merit functions:
`
`col. 70 In. 20-28). It would have been obvious to one skilled in the art to apply a function
`
`of causing improvement in some badnessfactor as taught by Zikan etal to the single
`
`flow processing means of Jacobsonet al to dynamically regulate each flow individually.
`
`Claims 11 and 31 are rejected under 35 U.S.C. 103(a) as being unpatentable
`
`over Jacobsonet al (US 2005/0226149 A1) in view of Afanador (US 6,167,041).
`
`Consider claims 11 and 31, as applied to claims 8 and 28, Jacobson et al
`
`disclose the claimed invention except may not have explicitly mentione