said router heuristically determining whether said flow exhibits undesirable behavior by
`
`comparing at least one of said payload-content-agnostic behavioral statistics to at least
`
`one pre-determined threshold value; and
`
`upon determination by said router that said flow exhibits undesirable behavior, enforcing,
`
`relative to at least one packet, a penalty;
`
`wherein
`
`the preceding steps are performed on said router without requiring use of inter-router
`
`data.
`
`42. (Currently Amended)
`
`A non-transitory computer-readable medium having computer-
`
`executable instructions for performing a methodto process a single flow, the flow comprising a
`
`plurality of packets, and the method comprising:
`
`creating a flow block as the first packet of a flowis processed by a single router;
`
`said flow block being configured to store payload-content agnostic bchavioralstatistics
`
`about said flow, regardless of the presence or absence of congestion;
`
`said router updating said flow block with the flow’s behavioral statistics of each packet
`
`belonging to said flow. as each packet[[s]] belongingto said flow [[are]] is processed by
`
`said router, regardless of the presence or absence of congestion;
`
`said router heuristically determining whether said flow is exhibiting undesirable behavior
`
`by comparingat least one of said behavioralstatistics to at least one pre-determined
`
`threshold value; and
`
`upon determination by said router that said flow is exhibiting undesirable behavior,
`
`enforcing,relative to at least onc packet belongingto said flow, a penalty;
`
`Attorney Docket No.: SABLE-01008
`
`Response to Office Action
`
`10
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 183
`
`Splunk Inc. Exhibit 1002 Page 183
`
`

`

`
`wherein said behavioral statistics for said flew are calculated by the preceding steps are
`
`performed onsaid router andindependent without requiring use of inter-router data.
`
`43. (Currently Amended)
`
`An article of manufacture comprising:
`
`a non-transitory computer-readable medium having stored thereon a data structure;
`
`a first field containing data representing a flow block;
`
`a secondfield containing data representing payload-content-agnostic behavioralstatistics
`
`about dropped and non-dropped packets of a flow;
`
`a third field containing data representing pre-determined behavior threshold values;
`
`a fourth field containing data representing the results of a heuristic determination of
`
`whether said flow exhibits undesirable behavior determined by comparing said
`
`behavioral statistics to said pre-determined threshold values;
`
`a fifth field containing data representing at least one penalty to be enforced against at
`
`lcast one packct upon determination that said flow exhibits undesirable behavior.
`
`44, (New)
`
`A machine implemented method for processing a flow, the flow comprising a
`
`series of information packets, the method comprising:
`
`
`maintaining a set of behavioral statistics for the flow, wherein the set of behavioral
`
`
`statistics is updated based on each information packet belonging to the flow, as each
`
`
`information packet belonging to the flow is processed:
`
`determining, basedat least partially upon the set of behavioral statistics. whether the flow
`
`is exhibiting undesirable behavior, regardless of the presence or absence of congestion;
`
`and
`
`in response to a determination that the flow is exhibiting undesirable behavior, enforcing
`
`a penalty on the flow.
`
`Attorney Docket No.: SABLE-01008
`
`Response to Office Action
`
`11
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 184
`
`Splunk Inc. Exhibit 1002 Page 184
`
`

`

`Response to Rejections under 35 USC §101
`
`Claims 42 and 43 were rejected for being directed to non-statutory subject matter. Claims
`
`42 and 43 are currently amended to specify a “non-transitory computer-readable medium.”
`
`Therefore, Applicant respectfully requests that these rejections be withdrawn.
`
`Response to Rejections under 35 USC §102(e)
`
`Independent claims 1, 5, 21, 25, 41, and 42 wererejected as being anticipated by
`
`Jacobson et al (US 2005/0226149 A1). “A claim is anticipated only if each and every element as
`
`set forth in the claims is found, either expressly or inherently described, in a single prior art
`
`reference.” Verdegaal Bros. v. Union Oil Co. ofCalifornia, 814 F.2d 628, 631, 2USPQ2d 1051,
`
`1053 (Fed.Cir. 1987). Jacobson does not teach every element of each rejected claim.
`
`Jacobson teaches a method:
`
`1)
`
`that is implemented only when triggered by a certain quantity of dropped packets;
`
`a.
`
`Jacobson, para [0092] lines 2-3: “A flow becomes a candidate for detection when
`
`its representation in the drop record is large;”
`
`b.
`
`Jacobson, para [0009] lines 11-12: “A flowis only tested if it has a significant
`
`share of the recordedtotal drops.”
`
`c. See also: Jacobson, para [0096]; claims 1, 10, 19;para [0011], lines 11-15; para
`
`[0012].
`
`2)
`
`is based on congestion levels;
`
`a.
`
`Jacobson, para [0009] lines 1-4: “A network device identifies a non-adaptive flow
`
`as follows. In the presence of congestion, the network device drops packets on a
`
`random basis using a Random Early Detection (RED) algorithm;”
`
`Attorney Docket No.: SABLE-01008
`
`Response to Office Action
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 185
`
`Splunk Inc. Exhibit 1002 Page 185
`
`

`

`b.
`
`Jacobson, para [0009] lines 4-7: “The RED algorithm is used by the network
`
`device to calculate a drop interval for the arriving packet stream based on the
`
`current congestion level of the target queue.”
`
`c.
`
`Jacobson, para [0034] lines 1-4: “A Random Early Detection (RED) gateway
`
`algorithm is executed within gateway 106 for congestion avoidance in network
`
`100. The RED gateway algorithm detects incipient congestion...”
`
`3) wherebystatistics are maintained only for packets that are dropped;
`
`a.
`
`Jacobson, para [0009], lines 7-9: “In this invention, when a packet is dropped, one
`
`or more headerfields of the packertare stored, along with a timestamp ofthe drop
`
`time;”
`
`b.
`
`Jacobson, para [0082]: “Table 900 has entries for the state data for dropped
`
`packets that is retained in an exemplary embodimentofthe invention...;”
`
`c.
`
`Jacobson, para [0084] & FIG. 10: showingthat statistics are maintained and
`
`analysis performed for dropped packets only;
`
`d.
`
`Jacobson, para [0085]: explaining that the adaptivenessof a flow is based on drop
`
`intervals;
`
`e.
`
`Jacobson, FIG. 9 entitled “State Maintained for Dropped Packets.”
`
`4)
`
`resulting in a determination of whether a flow is non-adaptive, based on drop intervals of
`
`the dropped packets.
`
`a.
`
`Jacobson, para [0012];
`
`b.
`
`Jacobson, FIG. 10 entitled “Flow Analysis for Dropped Packets;”
`
`c.
`
`Jacobson, para [0084] and [0085], discussing how state information for dropped
`
`packets is used to determine drop intervals and whethera flow is non-adaptive;
`
`Attorney Docket No.: SABLE-01008
`
`Response to Office Action
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 186
`
`Splunk Inc. Exhibit 1002 Page 186
`
`

`

`d.
`
`Jacobson, para [0010] lines 4-6: “The network device then appliesa statistical test
`
`to drop intervals of a plurality of flows in order to identify the non-adaptive
`39
`
`flow.
`
`In contrast to the Jacobson invention, Claim 1 of the present application teaches
`
`“maintaining a set of behavioral statistics for the flow, wherein the set of behavioral statistics is
`
`updated based on each information packet belonging to the flow, as each information packet
`
`belonging to the flow is processed.” Thus, the flow state is maintained for all packets in a flow,
`
`regardless of the end result of their processing. See Natchu, para [0006] and [0029].
`
`In other words, claim 1 is directed to a process whereby every packet in a flow is
`
`processed, accounted for, and subsequently dropped, forwarded, or otherwise treated; but, the
`
`Jacobson invention requiresfirst dropping packets, then analyzing the dropped packets, and
`
`subsequently labeling the overall flow as adaptive or non-adaptive.
`
`Thus, since Jacobson does not teach “maintaining a set of behavioralstatistics for the
`
`flow...based on each information packet,” claim | is not anticipated by Jacobson.
`
`Additionally, as referenced above, Jacobson is a congestion-based mechanism.It relies
`
`on the RED algorithm to drop packets prior to identifying a non-adaptive flow, and the very fact
`
`that the RED algorithm begins to drop packets indicates that there is an onset of congestion.It is
`
`at that point only that the remaining steps of the Jacobson method can be utilized or
`
`implemented. The RED algorithm is an algorithm to detect the onset of congestion, and it reacts
`
`to the queue size by dropping packets with certain drop probability, depending on the severity of
`
`congestion as indicated by the qucuc size levels (Jacobson, para [0034] lines 1-8). Furthermore,
`
`the paper referenced in paragraph 0034 of Jacobson, entitled “Random Early Detection
`
`Attorney Docket No.: SABLE-01008
`
`Response to Office Action
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 187
`
`Splunk Inc. Exhibit 1002 Page 187
`
`

`

`Gatewaysfor Congestion Avoidance,” explicitly says “the RED gateway detects incipient
`
`congestion by computing the average queue size. The gateway could notify connections of
`
`congestion either by dropping packets arriving at the gatewayor bysetting a bit in packet
`
`headers” (see Abstract of the referenced paper). The very fact that Jacobson’s non-adaptive flow
`
`detection mechanism relies on a RED packet drop as a trigger necessarily implies that the
`
`mechanism is valid only under congestion.
`
`In contrast, amended claim | of the present application teaches: “maintaining a set of
`
`behavioral statistics for the flow, wherein the set of behavioral statistics is updated. based on each
`
`information packet belonging to the flow, as each information packet belonging to the flowis
`
`processed, regardless ofthe presence or absence ofcongestion” (emphasis added). Jacobson
`
`does not anticipate the congestion-independentaspect of claim 1 (since, as explained above,the
`
`Jacobson mechanism is used exclusively in congestion-based situations), and therefore Applicant
`
`requests that the rejection to claim 1 be withdrawn.
`
`Moreover, the invention in Jacobsonis a nonanalogousreference to the present invention.
`
`A congestion-based, dropped packet-triggered, packet-selective, RED algorithm-based method is
`
`not a matter or invention which “logically would have commendeditself to an inventor’s
`
`attention in considering the invention” of a non-discriminatory, non-selective, all-packet
`
`processing mechanism for identifying and penalizing misbehaving flows, regardless of flow
`
`adaptiveness. (MPEP 2141.01(a)(1)). The matters with which the respective inventions deal are
`
`significantly different.
`
`In light of the above discussion, Application respectfully requests that the rejections to
`
`claim | be withdrawn.
`
`Claim 5 wasalso rejected as being anticipated by Jacobson. The elements of claim 5
`
`Attorney Docket No.: SABLE-01008
`
`Response to Office Action
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 188
`
`Splunk Inc. Exhibit 1002 Page 188
`
`

`

`parallel those of claim 1. Thus, the arguments made above with respect to claim 1 rejections also
`
`apply to the rejection of claim 5 under §102(e), and Applicant respectfully requests that the
`
`rejection to claim 5 be withdrawn.
`
`Claim 21 wasalso rejected as being anticipated by Jacobson. The elements of claim 21
`
`parallel those of claim 1. Thus, the arguments made above with respect to claim 1 rejections also
`
`apply to the rejection of claim 21 under $102(e), and Applicant respectfully requests that the
`
`rejection to claim 21 be withdrawn.
`
`Claim 25 wasalso rejected as being anticipated by Jacobson. The elements of claim 25
`
`parallel those of claim 1. Thus, the arguments made above with respect to claim | rejections also
`
`apply to the rejection of claim 25 under §102(e), and Applicant respectfully requests that the
`
`rejection to claim 25 be withdrawn.
`
`Claims 41 and 42 were also rejected as being anticipated by Jacobson. The elements of
`
`claims 41 and 42 parallel those of claim 1. Thus, the arguments made abovewith respect to
`
`claim | rejections also apply to the rejections of claims 41 and 42 under $102(e) and Applicant
`
`respectfully requests that the rejections to claims 41 and 42 be withdrawn.
`
`Claims2, 4, 6-8, 10, 22, 24, 27-29, and 30 werealso rejected as being anticipated by
`
`Jacobson. Claims 2 & 4 depend from claim 1; claims 6-8 and 10 depend from claim 5; claims 22
`
`& 24 depend from claim 21; and claims 27-29 and 30 depend from claim 25. Claims in
`
`dependent form shall be construed to include all the limitations of the claim incorporated by
`
`reference into the dependent claim. 37 CFR 1.75. As shown above, claims 1, 5,21, and 25 are
`
`not anticipated by Jacobson. Therefore, Applicant respectfully requests that the rejections to
`
`claims 2, 4, 6-8, 10, 22, 24, 27-29, and 30 be withdrawn as well.
`
`Attorney Docket No.: SABLE-01008
`
`Response to Office Action
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 189
`
`Splunk Inc. Exhibit 1002 Page 189
`
`

`

`Response to Rejections under 35 USC §103(a)
`
`Claims 3, 12-14, 18, 23, 32-34, and 38 were rejected as being unpatentable over Jacobson
`
`in view of Skirmont (US 6,252,848 B1). Claims 9 and 29 were rejected as being unpatentable
`
`over Jacobson in view of Zikan (US 6,310,881 B1). Claims 11 and 31 wererejected as being
`
`unpatentable over Jacobson in view of Afanador (US 6,167,041). Claims 15-17, 35-37 were
`
`rejected as being unpatentable over Jacobson in view ofScifres (US 7,113,990 B2). Claims 19,
`
`20, 39, and 40 were rejected as being unpatentable over Jacobson in view of Kejriwal (US
`
`6,934,250 B1).
`
`Theprior art reference (or references when combined) must teach or suggest all the claim
`
`limitations. MPEP §2143.
`
`Claims in dependent form shall be construed to include all the limitations of the claim
`
`incorporated by reference into the dependent claim. 37 CFR 1.75. Claim 3 is dependent on
`
`independent claim] and therefore includesall the limitations of claim 1. Claims 9, 11-17, 18-20
`
`are dependent on independent claim 5 and therefore include all the limitations of claim 5. Claim
`
`23 is dependent on independent claim 21 and therefore includesall the limitations of claim 21.
`
`Claims 29, 31-40 are dependent on independent claim 25 and therefore includeall the limitations
`
`of claim 25. As explained above with respect to the $102 rejections, independent claims 1, 5, 21,
`
`and 25 are not anticipated by Jacobson.It follows that Jacobson, in viewof any combination of
`
`cited references, does not teach or suggestall the claim limitations of claims 3, 9, 11-17, 18-20,
`
`23, 29, 31-40. Therefore, Applicant respectfully requests that the rejections to these claims be
`
`withdrawn.
`
`Morcover, with respect to claims 12 and 32, the Skirmontreference cannot be used to
`
`modify Jacobson to apply to non-congestion conditions. Column5, lines 21-24 were pointed out
`
`Attorney Docket No.: SABLE-01008
`
`Response to Office Action
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 190
`
`Splunk Inc. Exhibit 1002 Page 190
`
`

`

`in the Office Action. However, this specific reference simply states the fact that the RED
`
`algorithm may drop packets without regard to whether they were the packets causing congestion
`
`in the first place. But, the fact that packets were dropped due to the RED algorithm indicating the
`
`onset of congestion cannot be ignored. “The dropping of packets effectively signals congestion
`
`in a data network” (Skirmont, col. 1, lines 52-53 and col. 5, lines 17-18).
`
`Skirmont’s invention may teach a methodfor identifying which packets to drop in a
`
`congestion situation, but in the endit is still an invention to be utilized in congestion conditions,
`
`with dropped packets (and, as explained above, dropped packets happenat the onset of
`
`congestion). In contrast, claims 12 and 32 teach a mechanism that can operate on every packet,
`
`in the absence of congestion. Since a mechanism that stores behavioralstatistics about each
`
`packet, and which operates regardless of whether any congestion is encountered, is not taught or
`
`suggested by Jacobson and/or Skirmont, Applicant requests that these rejections be withdrawn.
`
`Likewise, Skirmont cannot be used in combination with Jacobson as a basis for rejecting any
`
`other claim, since independent claims 1, 5, 21, 25, 41, and 42 are all “regardless of the presence
`
`or absence of congestion.”
`
`Claim 43 was rejected as being unpatentable over Jacobson in view of Yazaki (US
`
`2010/0110889 A1). Claim 43 is currently amendedto specify “‘a second field containing data
`
`representing payload-content-agnostic behavioral statistics about dropped and non-dropped
`
`packets of a flow.” Jacobson does not teach or suggest gatheringstatistics pertaining to non-
`
`dropped packets of a flow. Moreover, Jacobson cannot be modified in any reasonable mannerto
`
`includestatistic or statistical analysis pertaining to any type of packets other than dropped
`
`packets. Thus, Jacobson, in viewof Yazaki, docs not teach or suggestall the claim limitations of
`
`claim 43 and Applicant respectfully requests that the rejections to this claim be withdrawn.
`
`Attorney Docket No.: SABLE-01008
`
`Response to Office Action
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 191
`
`Splunk Inc. Exhibit 1002 Page 191
`
`

`

`Conclusion
`
`Applicant respectfully asserts that the cited references do not render the claims
`
`unpatentable, either singularly or in combination. In light of the above, it is respectfully
`
`submitted that all of the claims now pendingin the subject patent application should be allowed
`
`and a Notice of Allowance is earnestly solicited. The Examineris respectfully requested to
`
`telephone the undersignedif she can assist in any way in expediting the issuance ofa patent.
`
`Respectfully submitted,
`
`/Sara Dirvianskis/
`By:
`Sara Dirvianskis
`Reg. No. 62613
`
`Dated: February 22, 2011
`
`West & Associates, A PC
`2815 Mitchell Drive, Suite 209
`Walnut Creek, CA 94598
`(925) 262-2220
`
`Attorney Docket No.: SABLE-01008
`
`Response to Office Action
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 192
`
`Splunk Inc. Exhibit 1002 Page 192
`
`

`

`Appendix A: Clean Copy of Amended Claims
`
`Attorney Docket No.: SABLE-01008
`
`Response to Office Action
`
`20
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 193
`
`Splunk Inc. Exhibit 1002 Page 193
`
`

`

`Whatis claimedis:
`
`1. (Currently Amended)
`
`A machine implemented methodfor processing a flow, the flow
`
`comprising a series of information packets, the method comprising:
`
`maintaining a set of behavioral statistics for the flow, wherein the set of behavioral
`
`statistics 1s updated based on each information packet belonging to the flow, as each
`
`information packet belongingto the flow is processed, regardless of the presence or
`
`absence of congestion;
`
`determining, based at least partially upon the set of behavioralstatistics, whether the flow
`
`is exhibiting undesirable behavior; and
`
`in response to a determination that the flow is exhibiting undesirable behavior, enforcing
`
`a penalty on the flow.
`
`2. (Original) The method of claim 1, wherein enforcing the penalty has an effect of correcting
`
`the flow's behavior such that the flow exhibits less undesirable behavior.
`
`3. (Original) The method of claim |, wherein enforcing the penalty comprises:
`
`imposing an increased drop rate on the flow such that the information packets belonging
`
`to the flow have a higher probability of being dropped than information packets
`
`belonging to other flows that do not exhibit undesirable behavior.
`
`4. (Original) The method of claim 1, wherein the penalty is enforced when a congestion
`
`condition is encountered.
`
`5. (Currently Amended)
`
`A machine implemented method for processing a flow, the flow
`
`comprising a series of information packets, the method comprising:
`
`maintaining a sct of behavioralstatistics for the flow, whercin the sct of bchavioral
`
`statistics is updated based on each information packet belongingto the flow, as each
`
`Attorney Docket No.: SABLE-01008
`
`Response to Office Action
`
`21
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 194
`
`Splunk Inc. Exhibit 1002 Page 194
`
`

`

`information packet belonging to the flow is processed, regardless of the presence or
`
`absence of congestion; and
`
`computing, based at least partially upon the set of behavioralstatistics, a badness factor
`
`for the flow, wherein the badness factor provides an indication of whether the flow is
`
`exhibiting undesirable behavior.
`
`6. (Original) The method of claim 5, wherein the badness factor also provides an indication of
`
`a degree to which the flow is behaving undesirably.
`
`7. (Original) The method of claim 6, further comprising:
`
`determining, basedat least partially upon the badness factor, a penalty to impose on the
`
`flow.
`
`8. (Original) The method of claim 7, further comprising: enforcing the penalty on the flow.
`
`9. (Original) The method of claim 8, wherein enforcing the penalty on the flow causes the flow
`
`to exhibit less undesirable behavior, thereby, causing the badnessfactor of the flow to improve.
`
`10. (Original) The method of claim 8, wherein the penalty is enforced on the flow when a
`
`congestion condition is encountered.
`
`11. (Original) The method of claim 8, wherein no penalty is enforced on the flowunless a
`
`congestion condition is encountered, regardless of how undesirably the flow is behaving.
`
`12. (Original) The method of claim 8, wherein the penalty is determined and enforced on the
`
`flow even when no congestion condition is encountered.
`
`13. (Original) The method of claim 8, wherein determining the penalty comprises:
`
`determining an increased drop rate to impose on one or more information packets
`
`belonging to the flow.
`
`14. (Original) The method of claim 13, wherein enforcing the penalty comprises:
`
`Attorney Docket No.: SABLE-01008
`
`Response to Office Action
`
`22
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 195
`
`Splunk Inc. Exhibit 1002 Page 195
`
`

`

`imposing the increased drop rate on the flow such that the information packets belonging
`
`to the flow have a higher probability of being dropped than information packets
`
`belonging to other flows that do not exhibit undesirable behavior.
`
`15. (Original) The method of claim 5, wherein the set of behavioral statistics comprises a
`
`measure T of how muchtotal information has been contained in all of the information packets
`
`belonging to the flow that have been forwarded up to a current pointin time.
`
`16. (Original) The method of claim 5, wherein the set of behavioral statistics comprises a
`
`measure L of how longthe flow has been in existence up to a current pointin time.
`
`17. (Original) The method of claim 16, wherein the set of behavioralstatistics comprises a rate
`
`R of information transfer for the flow, wherein R is derived by dividing T by L.
`
`18. (Original) The method of claim 5, wherein the set of behavioral statistics comprises an
`
`average size for the information packets belongingto the flow.
`
`19. (Original) The method of claim 5, whercin maintaining the sct of bchavioralstatistics
`
`comprises:
`
`receiving a particular information packet belonging to the flow;
`
`determining whether to forward the particular information packet to a destination; and
`
`in response to a determination to forward the particular information packet to the
`
`destination, updating the set of behavioralstatistics to reflect processing ofthe particular
`
`information packet.
`
`20. (Original) The method of claim 5, wherein maintaining the set of behavioralstatistics
`
`comprises:
`
`recciving a particular information packct belonging to the flow; and
`
`Attorney Docket No.: SABLE-01008
`
`Response to Office Action
`
`23
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 196
`
`Splunk Inc. Exhibit 1002 Page 196
`
`

`

`updating the set of behavioral statistics to reflect processing of the particular information
`
`packet, regardless of whether the particular information packet is discarded or forwarded
`
`to a destination.
`
`21. (Currently Amended)
`
`A misbehaving flow manager (MFM)for processing a flow,the
`
`flow comprising a series of information packets, the MFM comprising:
`
`means for maintaining a set of behavioralstatistics for the flow, wherein the set of
`
`behavioral statistics is updated based on each information packet belongingto the flow,
`
`as each information packet belongingto the flow is processed, regardless of the presence
`
`or absence of congestion;
`
`means for determining, based at least partially upon the set of behavioral statistics,
`
`whether the flow is exhibiting undesirable behavior; and
`
`means for enforcing, in response to a determination that the flow is exhibiting undesirable
`
`behavior, a penalty on the flow.
`
`22. (Original) The MFM ofclaim 21, wherein enforcing the penalty has an effect of correcting
`
`the flow's behavior such that the flow exhibits less undesirable behavior.
`
`23. (Original) The MFM ofclaim 21, wherein the means for enforcing the penalty comprises:
`
`means for imposing an increased drop rate on the flow such that the information packets
`
`belonging to the flow have a higher probability of being dropped than information
`
`packets belonging to other flows that do not exhibit undesirable behavior.
`
`24. (Original) The MFM ofclaim 21, wherein the penalty is enforced when a congestion
`
`condition is encountered.
`
`25. (Currently Amended)
`
`A misbchaving flow manager (MFM)for processing a flow,the
`
`flow comprising a series of information packets, the MFM comprising:
`
`Attorney Docket No.: SABLE-01008
`
`Response to Office Action
`
`24
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 197
`
`Splunk Inc. Exhibit 1002 Page 197
`
`

`

`means for maintaining a set of behavioral statistics for the flow, wherein the set of
`
`behavioral statistics is updated based on each information packet belongingto the flow,
`
`as each information packet belonging to the flow is processed, regardless of the presence
`
`or absence of congestion; and
`
`means for computing, basedat least partially upon the set of behavioralstatistics, a
`
`badness factor for the flow, wherein the badness factor provides an indication of whether
`
`the flowis exhibiting undesirable behavior.
`
`26. (Original) The MFM of claim 25, wherein the badness factor also provides an indication of a
`
`degree to which the flow is behaving undesirably.
`
`27. (Original) The MFM ofclaim 26, further comprising:
`
`means for determining, based at least partially upon the badness factor, a penalty to
`
`impose on the flow.
`
`28. (Original) The MFM ofclaim 27, further comprising: means for enforcing the penalty on the
`
`flow.
`
`29. (Original) The MFM ofclaim 28, wherein enforcing the penalty on the flow causes the flow
`
`to exhibit less undesirable behavior, thereby, causing the badnessfactor of the flow to improve.
`
`30. (Original) The MFM ofclaim 28, wherein the penalty is enforced on the flow when a
`
`congestion condition is encountered.
`
`31. (Original) The MFM of claim 28, wherein no penalty is enforced on the flow unless a
`
`congestion condition is encountered, regardless of how undesirably the flow is behaving.
`
`32. (Original) The MFM of claim 28, wherein the penalty is determined and enforced on the
`
`flow even when no congestion condition is encountered.
`
`33. (Original) The MFM ofclaim 28, wherein the means for determining the penalty comprises:
`
`Attorney Docket No.: SABLE-01008
`
`Response to Office Action
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 198
`
`Splunk Inc. Exhibit 1002 Page 198
`
`

`

`means for determining an increased drop rate to impose on one or more information
`
`packets belonging to the flow.
`
`34. (Original) The MFM ofclaim 33, wherein the means for enforcing the penalty comprises:
`
`means for imposing the increased drop rate on the flowsuch that the information packets
`
`belonging to the flow have a higher probability of being dropped than information
`
`packets belonging to other flows that do not exhibit undesirable behavior.
`
`35. (Original) The MFM ofclaim 25, wherein the set of behavioral statistics comprises a
`
`measure T of how muchtotal information has been contained inall of the information packets
`
`belongingto the flow that have been forwarded up to a current pointin time.
`
`36. (Original) The MFM of claim 25, wherein the set of behavioral statistics comprises a
`
`measure L of how long the flow has been in existence up to a current point in time.
`
`37. (Original) The MFM ofclaim 36, wherein the set of behavioral statistics comprises a rate R
`
`of information transfer for the flow, whercin R is derived by dividing T by L.
`
`38. (Original) The MFM ofclaim 25, wherein the set of behavioral statistics comprises an
`
`average size for the information packets belongingto the flow.
`
`39. (Original) The MFM ofclaim 25, wherein the means for maintaining the set of behavioral
`
`statistics comprises:
`
`meansfor receiving a particular information packet belongingto the flow;
`
`means for determining whether to forward the particular information packetto a
`
`destination; and
`
`meansfor updating, in response to a determination to forward the particular information
`
`packet to the destination, the sct of bchavioralstatistics to reflect processing of the
`
`particular information packet.
`
`Attorney Docket No.: SABLE-01008
`
`Response to Office Action
`
`26
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 199
`
`Splunk Inc. Exhibit 1002 Page 199
`
`

`

`40. (Original) The MFM of claim 25, wherein the means for maintaining the set of behavioral
`
`statistics comprises:
`
`meansfor receiving a particular information packet belonging to the flow; and
`
`means for updating the set of behavioralstatistics to reflect processing of the particular
`
`information packet, regardless of whether the particular information packetis discarded
`
`or forwardedto a destination.
`
`41. (Currently Amended)
`
`A machine-implemented method for processing a single flow, the
`
`flow comprising a plurality of packets, and the method comprising:
`
`creating a flow block as the first packet of a flowis processed by a single router;
`
`said flow block being configured to store payload-content-agnostic behavioralstatistics
`
`pertaining to said flow, regardless of the presence or absence of congestion;
`
`said router updating said flow block with the payload-content-agnostic behavioral
`
`statistics of cach packet belongingto said flow, as cach packct belonging to said flow is
`
`processed by said router, regardless of the presence or absence of congestion;
`
`said router heuristically determining whether said flow exhibits undesirable behavior by
`
`comparing at least one of said payload-content-agnostic behavioral statistics to at least
`
`one pre-determined threshold value; and
`
`upon determination by said router that said flow exhibits undesirable behavior, enforcing,
`
`relative to at least one packet, a penalty;
`
`wherein the preceding steps are performed on said router without requiring use ofinter-
`
`router data.
`
`Attorney Docket No.: SABLE-01008
`
`Response to Office Action
`
`27
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 200
`
`Splunk Inc. Exhibit 1002 Page 200
`
`

`

`42. (Currently Amended)
`
`A non-transitory computer-readable medium having computer-
`
`executable instructions for performing a methodto process a single flow, the flow comprising a
`
`plurality of packets, and the method comprising:
`
`creating a flow block as the first packet of a flow is processed by a single router;
`
`said flow block being configured to store payload-content agnostic behavioral statistics
`
`about said flow, regardless of the presence or absence of congestion;
`
`said router updating said flow block with the flow’s behavioralstatistics of each packet
`
`belongingto said flow, as each packet belonging to said flowis processed by said router,
`
`regardless of the presence or absence of congestion;
`
`said router heuristically determining whether said flow is exhibiting undesirable behavior
`
`by comparingat least one of said behavioralstatistics to at least one pre-determined
`
`threshold value; and
`
`upon determination by said router that said flow is exhibiting undesirable behavior,
`
`enforcing,relative to at least one packet belongingto said flow, a penalty;
`
`wherein the preceding steps are performed on said router without requiring use of inter-
`
`router data.
`
`43. (Currently Amended)
`
`—_Anarticle of manufacture comprising:
`
`a non-transitory computer-readable medium having stored thereon a data structure;
`
`a first field containing data representing a flow block;
`
`a secondfield containing data representing payload-content-agnostic behavioralstatistics
`
`about dropped and non-dropped packets of a flow;
`
`a third ficld containing data representing pre-determined behavior threshold valucs;
`
`Attorney Docket No.: SABLE-01008
`
`Response to Office Action
`
`28
`
`Splunk Inc.
`
`Exhibit1002
`
`Page 201
`
`Splunk Inc. Exhibit 1002 Page 201
`
`

`

`a fourth field containing data representing the results of a heuristic determination of
`
`whether said flow exhibits undesirable behavior determined by comparing said
`
`behavioral statistics to said pre-determined threshold val