Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendments and Arguments
Applicant's arguments filed 25 March 2026 have been fully considered but they are not persuasive.
Upon further consideration and examination of Ramaswamy, Ramaswamy teaches a network device for sampling traffic flows. In addition to teaching a network device for sampling traffic flows, Ramaswamy discloses receiving a plurality of ingress data traffic flows, dropping a data packet in the ingress data traffic, generating at least one samplings rules with criteria defined using parameters of the dropped data packet with the parameters identify a targeted flow containing the dropped packet in response to dropping a packet in the ingress data traffic, and reporting the samples of data packets to at least one collector.
“…in response to dropping the data packet in the ingress data traffic, generating one or more sampling rules whose match criteria are defined using parameters of the dropped data packet, wherein the parameters identify match packets of a flow ("targeted flow") that contains the dropped data packet;”
(See Ramaswamy paragraph 0052, ...at 420, the controller dynamically generates trace monitoring rules based on the detected anomaly. Continuing with the dropped packet example above, in some embodiments, the controller may generate trace monitoring rules to trace N number of packets belonging to any flows that are processed by the particular node that is experiencing a too-large number of dropped packets.)
Shows generating sampling rules to match criteria of multiple flows
However, Ramaswamy further teaches trace monitoring rules be able to identify a signle targeted flow as stated in paragraph 0005.
(See Ramaswamy paragraph 0005, At the flow level, trace monitoring rules in some embodiments can be specified to target a particular packet flow across nodes in the SD-WAN.)
Shows the rules may be specified for a particular flow
In paragraph 0009, Ramaswamy discloses multiple parameters being utilized to identify the anomaly or dropped data packet with the multiple parameters.
(See Ramaswamy paragraph 0009, ...some embodiments allow a user to select individual packet processing stages to see information (e.g., in a pop-up window) regarding the packet flow processed by the stage when the anomaly was detected as well as a description of the error or anomaly experienced on that stage. More specifically, the packet flow information includes source and destination network addresses, source and destination ports, and application ID, according to some embodiments.)
Shows the flow of the anomaly being identified by multiple parameters of source and destination network addresses, source and destination ports, and application ID
Further, Ramaswamy teaches utilizing full five-tuple match criteria for flow-level trace monitoring rules to target a single specific flow in paragraph 0057.
(See Ramaswamy paragraph 0057, Flow-level trace monitoring rules, in some embodiments, can specify full five-tuple match criteria and can be used to target a specific flow across one or more nodes.)
Shows the flow-level trace monitoring rules specify full five-tuple match criteria and may be used to target a specific flow
On the other hand, K teaches programming one or more sampling rules in a memory of the network device and sampling ingress data traffic received subsequent to the programming using the one or more sampling rules to obtain samples of data packets contained in the targeted flow.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 10, 11, 12, 17, 18, and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K.
Claim 1
Ramaswamy teaches,
A method in a network device for sampling traffic flows, the method comprising:
receiving ingress data traffic, wherein the ingress data traffic comprises a plurality of flows;
(See Ramaswamy paragraph 0045, ...packets received at the node are received by the ingress packet processing stage (e.g., packet processing stage 230). The process then determines (at 315) whether the received packet belongs to the particular packet flow for which the trace monitoring rules are specified.)
dropping a data packet in the ingress data traffic;
(See Ramaswamy paragraph 0051, ...a node in some embodiments may detect that one or more stages in the packet processing stages of the node have dropped greater than a specified threshold of packets,...)
in response to dropping the data packet in the ingress data traffic, generating one or more sampling rules whose match criteria are defined using parameters of the dropped data packet, wherein the parameters identify match packets of a flow ("targeted flow") that contains the dropped data packet;
(See Ramaswamy paragraph 0052, ...at 420, the controller dynamically generates trace monitoring rules based on the detected anomaly. Continuing with the dropped packet example above, in some embodiments, the controller may generate trace monitoring rules to trace N number of packets belonging to any flows that are processed by the particular node that is experiencing a too-large number of dropped packets.)
Shows generating sampling rules to match criteria of multiple flows
(See Ramaswamy paragraph 0005, At the flow level, trace monitoring rules in some embodiments can be specified to target a particular packet flow across nodes in the SD-WAN.)
Shows the rules may be specified for a particular flow
(See Ramaswamy paragraph 0009, ...some embodiments allow a user to select individual packet processing stages to see information (e.g., in a pop-up window) regarding the packet flow processed by the stage when the anomaly was detected as well as a description of the error or anomaly experienced on that stage. More specifically, the packet flow information includes source and destination network addresses, source and destination ports, and application ID, according to some embodiments.)
Shows the flow of the anomaly being identified by multiple parameters of source and destination network addresses, source and destination ports, and application ID
(See Ramaswamy paragraph 0057, Flow-level trace monitoring rules, in some embodiments, can specify full five-tuple match criteria and can be used to target a specific flow across one or more nodes.)
Shows the flow-level trace monitoring rules specify full five-tuple match criteria and may be used to target a specific flow
…reporting the samples of data packets to at least one collector.
(See Ramaswamy paragraph 0049, ...each packet processing stage 230-240 on a node 220 collects trace monitoring data for packets that are marked for trace monitoring and provides the data to the trace monitor 222.)
However, Ramaswamy fails to explicitly teach,
…programming the one or more sampling rules in a memory of the network device;
sampling ingress data traffic received subsequent to the programming using the one or more sampling rules to obtain samples of data packets contained in the targeted flow; and…
Nevertheless, K, in the same field of endeavor, teaches,
…programming the one or more sampling rules in a memory of the network device;
(See K paragraph 0080, ...the trace policy engine 115 determines which flows should be traced and then causes the SDN controller to program a packet processing pipeline 120 of a switch 100 to trace packets belonging to those flows.)
sampling ingress data traffic received subsequent to the programming using the one or more sampling rules to obtain samples of data packets contained in the targeted flow; and…
(See K paragraph 0093, The switch 100 also copies, at the (current) flow table, content of a second field associated with the packet to the first field associated with the packet before directing the packet to a subsequent flow table of the packet processing pipeline 120 (block 620). This allows the packet to be traced at the subsequent flow table.)
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filling data of the claimed invention to combine receiving ingress data traffic, dropping a data packet in the data traffic, generating a sampling rule according to the targeted flow of the dropped packet and reporting the samples of data packets to at least one collector as disclosed by Ramaswamy with programming sample rules in a network device and sampling subsequent data traffic according to the configured rule with dropped packet as disclosed by K to increase the efficiency of the system (i.e. to prevent subsequent dropped packets).
Claim 11
Ramaswamy teaches,
A network device comprising: one or more computer processors; a memory;
(See Ramaswamy paragraph 0086, ...microprocessors, storage and memory that store computer program instructions in a machine-readable or computer-readable medium (alternatively referred to as computer-readable storage media, machine-readable media, or machine-readable storage media).)
and a computer-readable storage device comprising instructions for controlling the one or more computer processors to:
(See Ramaswamy paragraph 0086, The computer-readable media may store a computer program that is executable by at least one processing unit and includes sets of instructions for performing various operations.)
receive ingress data traffic, wherein the ingress data traffic comprises a plurality of flows;
(See Ramaswamy paragraph 0045, ...packets received at the node are received by the ingress packet processing stage (e.g., packet processing stage 230). The process then determines (at 315) whether the received packet belongs to the particular packet flow for which the trace monitoring rules are specified.)
drop a data packet in the ingress data traffic;
(See Ramaswamy paragraph 0051, ...a node in some embodiments may detect that one or more stages in the packet processing stages of the node have dropped greater than a specified threshold of packets,...)
subsequent to the dropped data packet, trigger sampling a flow ("targeted flow") that contains the dropped data packet, wherein parameters of the dropped data packet identify the targeted flow,…
(See Ramaswamy paragraph 0052, ...at 420, the controller dynamically generates trace monitoring rules based on the detected anomaly. Continuing with the dropped packet example above, in some embodiments, the controller may generate trace monitoring rules to trace N number of packets belonging to any flows that are processed by the particular node that is experiencing a too-large number of dropped packets.)
Shows generating sampling rules to match criteria of multiple flows
(See Ramaswamy paragraph 0005, At the flow level, trace monitoring rules in some embodiments can be specified to target a particular packet flow across nodes in the SD-WAN.)
Shows the rules may be specified for a particular flow
(See Ramaswamy paragraph 0009, ...some embodiments allow a user to select individual packet processing stages to see information (e.g., in a pop-up window) regarding the packet flow processed by the stage when the anomaly was detected as well as a description of the error or anomaly experienced on that stage. More specifically, the packet flow information includes source and destination network addresses, source and destination ports, and application ID, according to some embodiments.)
Shows the flow of the anomaly being identified by multiple parameters of source and destination network addresses, source and destination ports, and application ID
(See Ramaswamy paragraph 0057, Flow-level trace monitoring rules, in some embodiments, can specify full five-tuple match criteria and can be used to target a specific flow across one or more nodes.)
Shows the flow-level trace monitoring rules specify full five-tuple match criteria and may be used to target a specific flow
…transmit the sampled data packets of the targeted flow to at least one collector.
(See Ramaswamy paragraph 0049, ...each packet processing stage 230-240 on a node 220 collects trace monitoring data for packets that are marked for trace monitoring and provides the data to the trace monitor 222.)
However, Ramaswamy fails to explicitly teach,
…wherein all data packets of the targeted flow are sampled; and
Nevertheless, K, in the same field of endeavor, teaches,
…wherein all data packets of the targeted flow are sampled; and
(See K paragraph 0080, ...the trace policy engine 115 determines which flows should be traced and then causes the SDN controller to program a packet processing pipeline 120 of a switch 100 to trace packets belonging to those flows.)
Shows all the packets according to the determination of the policy engine to be traced or sampled
The motivation to combine Ramaswamy and K in the independent claim consists of the same motivation as stated in claim 1.
Claim 12
Ramaswamy teaches,
The network device of claim 11, wherein the computer-readable storage device further comprises instructions for controlling the one or more computer processors to:
(See Ramaswamy paragraph 0086, The computer-readable media may store a computer program that is executable by at least one processing unit and includes sets of instructions for performing various operations.)
…program the one or more sampling rules in the memory of the network device to sample the data packets of the targeted flow.
(See Ramaswamy paragraph 0181, The packet and associated information and metadata (e.g., a domain name, time, location, direction, origin, attack type estimate, rate estimates, etc.) may be recorded for statistics purposes, packet and associated information and metadata may be logged and/or captured, and the packet and associated information and metadata may be stored in MEMORY-STORE 1532.)
generate one or more sampling rules that match on data packets of the targeted flow in response to the dropped data packet; and…
(See Ramaswamy paragraph 0052, ...at 420, the controller dynamically generates trace monitoring rules based on the detected anomaly. Continuing with the dropped packet example above, in some embodiments, the controller may generate trace monitoring rules to trace N number of packets belonging to any flows that are processed by the particular node that is experiencing a too-large number of dropped packets.)
However, Ramaswamy fails to explicitly teach,
…program the one or more sampling rules in the memory of the network device to sample the data packets of the targeted flow.
Nevertheless, K, in the same field of endeavor, teaches,
…program the one or more sampling rules in the memory of the network device to sample the data packets of the targeted flow.
(See K paragraph 0080, ...the trace policy engine 115 determines which flows should be traced and then causes the SDN controller to program a packet processing pipeline 120 of a switch 100 to trace packets belonging to those flows.)
The motivation to combine Ramaswamy and K in the independent claim consists of the same motivation as stated in claim 1.
Claim 18
Ramaswamy teaches,
A non-transitory computer-readable storage device in a network device, the non- transitory computer-readable storage device having stored thereon computer executable instructions, which when executed, cause the network device to:
(See Ramaswamy paragraph 0086, The computer-readable media may store a computer program that is executable by at least one processing unit and includes sets of instructions for performing various operations.)
receive ingress data traffic, wherein the ingress data traffic comprises a plurality of flows;
(See Ramaswamy paragraph 0045, ...packets received at the node are received by the ingress packet processing stage (e.g., packet processing stage 230). The process then determines (at 315) whether the received packet belongs to the particular packet flow for which the trace monitoring rules are specified.)
drop a data packet in the ingress data traffic;
(See Ramaswamy paragraph 0051, ...a node in some embodiments may detect that one or more stages in the packet processing stages of the node have dropped greater than a specified threshold of packets,...)
subsequent to the dropped data packet, trigger sampling a flow ("targeted flow") that contains the dropped data packet, wherein parameters of the dropped data packet identify the targeted flow,…
(See Ramaswamy paragraph 0052, ...at 420, the controller dynamically generates trace monitoring rules based on the detected anomaly. Continuing with the dropped packet example above, in some embodiments, the controller may generate trace monitoring rules to trace N number of packets belonging to any flows that are processed by the particular node that is experiencing a too-large number of dropped packets.)
Shows generating sampling rules to match criteria of multiple flows
(See Ramaswamy paragraph 0005, At the flow level, trace monitoring rules in some embodiments can be specified to target a particular packet flow across nodes in the SD-WAN.)
Shows the rules may be specified for a particular flow
(See Ramaswamy paragraph 0009, ...some embodiments allow a user to select individual packet processing stages to see information (e.g., in a pop-up window) regarding the packet flow processed by the stage when the anomaly was detected as well as a description of the error or anomaly experienced on that stage. More specifically, the packet flow information includes source and destination network addresses, source and destination ports, and application ID, according to some embodiments.)
Shows the flow of the anomaly being identified by multiple parameters of source and destination network addresses, source and destination ports, and application ID
(See Ramaswamy paragraph 0057, Flow-level trace monitoring rules, in some embodiments, can specify full five-tuple match criteria and can be used to target a specific flow across one or more nodes.)
Shows the flow-level trace monitoring rules specify full five-tuple match criteria and may be used to target a specific flow
…and transmit the sampled data packets of the targeted flow to at least one collector.
(See Ramaswamy paragraph 0049, ...each packet processing stage 230-240 on a node 220 collects trace monitoring data for packets that are marked for trace monitoring and provides the data to the trace monitor 222.)
However, Ramaswamy fails to explicitly teach,
…wherein all data packets of the targeted flow are sampled;…
Nevertheless, K, in the same field of endeavor, teaches,
…wherein all data packets of the targeted flow are sampled;…
(See K paragraph 0080, ...the trace policy engine 115 determines which flows should be traced and then causes the SDN controller to program a packet processing pipeline 120 of a switch 100 to trace packets belonging to those flows.)
Shows all the packets according to the determination of the policy engine to be traced or sampled
The motivation to combine Ramaswamy and K in the independent claim consists of the same motivation as stated in claim 1.
Claim 19
Ramaswamy teaches limitations of claim 19 as stated in claim 12. However, Ramaswamy fails to explicitly teach limitations of claim 19 as stated in claim 12. Nevertheless, K, in the same field of endeavor, teaches limitations of claim 19 as stated in claim 12. The motivation to combine Ramaswamy and K in dependent claim consists of the same motivation as stated in claim 1.
Claim 10
Ramaswamy fails to explicitly teach limitations of claim 10. Nevertheless, K, in the same field of endeavor, teaches,
The method of claim 1, wherein reporting the samples of data packets includes generating Postcard Telemetry packets that comprise the samples of data packets.
(See K paragraph 0031, A postcard is a truncated copy of the packet's header, augmented with an indication of the matching flow entry, an indication of the switch, and an indication of the output port. A collector module collects such postcards and is able to trace the packet based on an analysis of the collected postcards.)
The motivation to combine Ramaswamy K in the dependent claim consists of the same motivation as stated in claim 1.
Claim 17
Ramaswamy teaches,
The network device of claim 11, wherein the computer-readable storage device further comprises instructions for controlling the one or more computer processors…
(See Ramaswamy paragraph 0086, The computer-readable media may store a computer program that is executable by at least one processing unit and includes sets of instructions for performing various operations.)
However, K, in the same field of endeavor, teaches limitations of claim 17 as stated in claim 10. The motivation to combine Ramaswamy and K in the dependent claim consists of the same motivation as stated in claim 1.
Claims 2, 3, 4, 6 and 16 are rejected under 35 U.S.C. 103 as being unpatentable over Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Phaal (US 20150281085 A1).
Claim 2
Ramaswamy fails to explicitly teach limitations of claim 2. Nevertheless, Phaal, in the same field of endeavor, teaches,
The method of claim 1, wherein prior to the network device dropping the dropped data packet, data packets in the targeted flow were at most randomly sampled.
(See paragraph Phaal 0022, The packet sampler of switching/routing module 260 is configured to randomly sample packets that transit the module, and extracts information from the sampled packets.)
Shows randomly sampled targeted flow
(See paragraph Phaal 0028, The table of the network device may be made up of a number of OpenFlow entries, each of the entries consists of a filter configured to match flows and an action configured to drop, rate limit, replicate packets, and/or alter paths taken by the packets when the flows match the filter. )
Shows the dropping of packets according to a filter on the randomly sampled targeted flow
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filling data of the claimed invention to combine receiving ingress data traffic, dropping a data packet in the data traffic, generating a sampling rule according to the targeted flow of the dropped packet and reporting the samples of data packets to at least one collector as disclosed by Ramaswamy with randomly sampling the targeted traffic prior to dropping the data packet as disclosed by Phaal to increase the efficiency of the system (i.e. to reduce the number of sampled packets in the targeted traffic).
Claim 3
Ramaswamy fails to explicitly teach limitations of claim 3. Nevertheless, Phaal, in the same field of endeavor, teaches,
The method of claim 1, further comprising deleting the one or more sampling rules at a time when the targeted flow is deemed to be no longer experiencing dropped packets.
(See Phaal paragraph 0031, Once the rule is received by the switch, the traffic is dropped and no longer reaches the intended victim. The controller later removes the rule, either based on a timeout, or because the traffic is no longer being observed by analytics software.)
The motivation to combine Ramaswamy, K, and Phaal in the dependent claim consists of the same motivation as stated in claim 2.
Claim 4
Ramaswamy fails to explicitly teach limitations of claim 4. Nevertheless, Phaal, in the same field of endeavor, teaches,
The method of claim 3, wherein the targeted flow is deemed to be no longer experiencing dropped packets when the targeted flow has not exhibited a packet drop for a predetermined period of time.
(See Phaal paragraph 0031, Once the rule is received by the switch, the traffic is dropped and no longer reaches the intended victim. The controller later removes the rule, either based on a timeout, or because the traffic is no longer being observed by analytics software.)
The motivation to combine Ramaswamy, K and Phaal in the dependent claim consists of the same motivation as stated in claim 2.
Claim 6
Ramaswamy fails to explicitly teach limitations of claim 6. Nevertheless, Phaal, in the same field of endeavor, teaches,
The method of claim 1, further comprising distributing the one or more sampling rules to other network devices in the network, wherein the other network devices sample their respective ingress data traffic using the one or more sampling rules to identify data packets in the targeted flow…
(See Phaal paragraph 0030, When a large flow is detected by the controller it creates a filter matching the specific destination address and protocol attributes of the detected large flow and uses OpenFlow to send a rule to a switch reporting the traffic in order to match and drop the traffic associated with the DDoS attack,...)
The motivation to combine Ramaswamy, K, and Phaal in the dependent claim consists of the same motivation as stated in claim 2.
K teaches,
…and report on their respective identified data packets to the collector.
(See K paragraph 0031, One conventional technique for troubleshooting packet processing in an SDN network sends a small “postcard” every time a packet visits a switch. A postcard is a truncated copy of the packet's header, augmented with an indication of the matching flow entry, an indication of the switch, and an indication of the output port. A collector module collects such postcards and is able to trace the packet based on an analysis of the collected postcards.)
The motivation to combine Ramaswamy, K, and Phaal in the dependent claim consists of the same motivation as stated in claim 2.
Claim 16
Ramaswamy teaches,
The network device of claim 11, wherein the computer-readable storage device further comprises instructions for controlling the one or more computer processors to…
(See Ramaswamy paragraph 0086, The computer-readable media may store a computer program that is executable by at least one processing unit and includes sets of instructions for performing various operations.)
Ramaswamy fails to explicitly teach limitations of claim 16. Nevertheless, Phaal, in the same field of endeavor, teaches limitations of claim 16 as stated in claim 4. The motivation to combine Ramaswamy, K and Phaal in the dependent claim consists of the same motivation as stated in claim 2.
Claim 5 is rejected under 35 U.S.C. 103 as being unpatentable over Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Phaal (US 20150281085 A1) in further view of Castellanos Zamora et al. (US 20110022722 A1) or Castellanos Zamora.
Claim 5
Ramaswamy fails to explicitly teach limitations of claim 5. Nevertheless, Phaal, in the same field of endeavor, teaches,
The method of claim 3, further comprising, before deleting the one or more sampling rules,… …that the targeted flow is deemed to be no longer experiencing dropped packets.
(See Phaal paragraph 0031, Once the rule is received by the switch, the traffic is dropped and no longer reaches the intended victim. The controller later removes the rule, either based on a timeout, or because the traffic is no longer being observed by analytics software.)
Shows the targeted flow fails to experience dropped packets
The motivation to combine Ramaswamy, K and Phaal in the dependent claim consists of the same motivation as stated in claim 2.
Castellanos Zamora teaches,
…delaying for a period of time after a point in time…
(See Castellanos Zamora, paragraph 0052, Rather than implement the delay timer at the PCRF, the PCRF may request that the PCEF initiate the timer and remove the PCC rules for the existing filter information upon expiry of the timer. This approach may indeed be optimal where a single message from the PCRF is used to install both new rules and trigger the delayed removal of the existing rules.)
Shows the delaying of removing an existing rule
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filling data of the claimed invention to combine receiving ingress data traffic, dropping a data packet in the data traffic, generating a sampling rule according to the targeted flow of the dropped packet and reporting the samples of data packets to at least one collector as disclosed by Ramaswamy with delaying the removal of a rule as disclosed by Castellanos Zamora to increase the efficiency of the system (i.e. to reduce the probability of the dropped packets).
Claims 7 and 14 are rejected under 35 U.S.C. 103 as being unpatentable over Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Pal et al. (US 20170126725 A1) or Pal in further view of Kojima et al. (US 20150264071 A1) or Kojima.
Claim 7
Ramaswamy fails to explicitly teach limitations of claim 7. Nevertheless, Pal, in the same field of endeavor, teaches,
The method of claim 6, wherein distributing… …includes sending… …to a network management system,
wherein the network management system distributes the one or more… …to the other network devices.
(See Kojima paragraph 0018, The analysis apparatus 1 includes an analysis unit 12 which receives communication data (sample data) sampled by the sampling devices in the monitoring-target system 3, and analyzes the possibility of a security incident by using the sample data. The analysis apparatus 1 also includes a sampling rule management unit 11. As a result of an analysis of the sample data by the analysis unit 12, if it is determined that there is a possibility of occurrence of a security incident, the sampling rule management unit 11 instructs, in accordance with the analysis result, the sampling devices 2 to change sampling rules for acquiring communication data and transmitting the communication data to the analysis apparatus 1.)
Shows transmitting data to network management system and the network management system distributing sampling data to other network devices
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filling data of the claimed invention to combine receiving ingress data traffic, dropping a data packet in the data traffic, generating a sampling rule according to the targeted flow of the dropped packet and reporting the samples of data packets to at least one collector as disclosed by Ramaswamy with transmitting sampling data to a network management system and the network management system distributing the sampling data to other devices as disclosed by Kojima to increase the efficiency of the system (i.e. to reduce the number of steps required to distribute data across a network).
Pal teaches,
…the one or more sampling rules…
…the one or more sampling rules…
…sampling rules…
(See Pal paragraph 0059, To adjust the sampling policy, offline policy manager 422 may itself change the sampling policy and then send a copy of the changed sampling policy to online policy enforcer 421.)
Shows the transmission of a sampling rule from one device to another device
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filling data of the claimed invention to combine receiving ingress data traffic, dropping a data packet in the data traffic, generating a sampling rule according to the targeted flow of the dropped packet and reporting the samples of data packets to at least one collector as disclosed by Ramaswamy with transmitting sampling rule from one device to another device as disclosed by Pal to increase the security of the system (i.e. to increase protection against malicious packets entering a network).
Claim 14
Ramaswamy teaches,
The network device of claim 12, wherein the computer-readable storage device further comprises instructions for controlling the one or more computer processors…
(See Ramaswamy paragraph 0086, The computer-readable media may store a computer program that is executable by at least one processing unit and includes sets of instructions for performing various operations.)
However, Ramaswamy fails to explicitly teach,
…to send the one or more sampling rules to a network management system, wherein the network management system distributes the one or more sampling rules to the other network devices in a data network.
Nevertheless, Pal and Kojima, in the same field of endeavor, teach limitations of claim 14 as stated in claim 7. The motivation to combine Ramaswamy, K, Pal, and Kojima in the dependent claim consists of the same motivation as stated in claim 7.
Claims 8, 9 and 15 are rejected under 35 U.S.C. 103 as being unpatentable over Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Pignataro et al. (US 20240323090 A1) or Pignataro.
Claim 8
Ramaswamy fails to explicitly teach limitations of claim 8. Nevertheless, Pignataro, in the same field of endeavor, teaches,
The method of claim 6, wherein distributing the one or more sampling rules includes the network device sending the one or more sampling rules to the other network devices in the network.
(See Pignataro paragraph 0068, Upon defining the criteria, the sampling policy logic 302 can transmit the criteria to both a power consumption profiling logic 303 (step 2A), and to one or more configuration tools 304 (step 2B) that can manage the different sampling configurations on the various elements of the network devices within the multi-layer topology 202.)
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filling data of the claimed invention to combine receiving ingress data traffic, dropping a data packet in the data traffic, generating a sampling rule according to the targeted flow of the dropped packet and reporting the samples of data packets to at least one collector as disclosed by Ramaswamy with transmitting sampling rule from one device to other devices in a network as disclosed by Pignataro to increase the efficiency of the system (i.e. to increase the number of network devices utilizing a sampling rule for reducing packet loss).
Claim 9
Ramaswamy fails to explicitly teach limitations of claim 9. Nevertheless, Pignataro, in the same field of endeavor, teaches,
The method of claim 6, wherein the one or more sampling rules are distributed to network devices on a path of the targeted flow.
(See Pignataro paragraph 0068, As a result, in many embodiments, the different sampling configurations within the defined criteria are transmitted or pushed to all of the elements affected, including within the sustainability aggregation entity 201 itself, and the one or more observability elements 315 (step 3). In further embodiments, the sampling can be done by a specific device and transmitted to each network device on command or as needed.)
The motivation to combine Ramaswamy, K and Pignataro in the dependent claim consists of the same motivation as stated in claim 8.
Claim 15
Ramaswamy teaches,
The network device of claim 12, wherein the computer-readable storage device further comprises instructions for controlling the one or more computer processors
(See Ramaswamy paragraph 0086, The computer-readable media may store a computer program that is executable by at least one processing unit and includes sets of instructions for performing various operations.)
However, Ramaswamy fails to explicitly teach,
…to send the one or more sampling rules to the other network devices in a data network.
Nevertheless, Pignataro, in the same field of endeavor, teaches limitations of claim 15 as stated in claim 8.
The motivation to combine Ramaswamy, K and Pignataro in the dependent claim consists of the same motivation as stated in claim 8.
Claims 13 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Pignataro et al. (US 20240323090 A1) or Pignataro in further view Kojima et al. (US 20150264071 A1) or Kojima.
Claim 13
Ramaswamy teaches,
The network device of claim 12, wherein the computer-readable storage device further comprises instructions for controlling the one or more computer processors
(See Ramaswamy paragraph 0086, The computer-readable media may store a computer program that is executable by at least one processing unit and includes sets of instructions for performing various operations.)
However, Ramaswamy fails to explicitly teach,
…to distribute the one or more sampling rules to other network devices in a data network,…
Nevertheless, Piganataro, in the same field of endeavor, teaches,
…to distribute the one or more sampling rules to other network devices in a data network,…
(See Pignataro paragraph 0068, Upon defining the criteria, the sampling policy logic 302 can transmit the criteria to both a power consumption profiling logic 303 (step 2A), and to one or more configuration tools 304 (step 2B) that can manage the different sampling configurations on the various elements of the network devices within the multi-layer topology 202.)
The motivation to combine Ramaswamy, K and Pignataro in the dependent claim consists of the same motivation as stated in claim 8.
However, Ramaswamy fails to explicitly teach,
…wherein network devices on a path of the targeted flow sample the data packets of the targeted flow and transmit the sampled data packets to the at least one collector.
Nevertheless, Kojima, in the same field of endeavor, teaches,
…wherein network devices on a path of the targeted flow sample the data packets of the targeted flow and transmit the sampled data packets to the at least one collector.
(See Kojima paragraph 0018, The analysis apparatus 1 includes an analysis unit 12 which receives communication data (sample data) sampled by the sampling devices in the monitoring-target system 3, and analyzes the possibility of a security incident by using the sample data. The analysis apparatus 1 also includes a sampling rule management unit 11. As a result of an analysis of the sample data by the analysis unit 12, if it is determined that there is a possibility of occurrence of a security incident, the sampling rule management unit 11 instructs, in accordance with the analysis result, the sampling devices 2 to change sampling rules for acquiring communication data and transmitting the communication data to the analysis apparatus 1.)
The motivation to combine Ramaswamy, K and Kojima in the dependent claim consists of the same motivation as stated in claim 7.
Claim 20
Ramaswamy teaches,
The non-transitory computer-readable storage device of claim 18, wherein the computer executable instructions, which when executed, further cause the network device to distribute…
(See Ramaswamy paragraph 0086, The computer-readable media may store a computer program that is executable by at least one processing unit and includes sets of instructions for performing various operations.)
However, Ramaswamy fails to explicitly teach limitations of claim 20 as stated in claim 13. Nevertheless, Pignataro and Kojima, in the same field of endeavor, teach limitations of claim 20 as stated in claim 13. The motivation to combine Ramaswamy, K and Pignataro in the dependent claim consists of the same motivation as stated in claim 8. The motivation to combine Ramaswamy, K and Kojima in the dependent claim consists of the same motivation as stated in claim 7.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Kwan et al. (US 11075847 B1) or Kwan teaches sampling based upon an event such as a dropped packet.
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SAMUEL ROBERGE BETTENDORF whose telephone number is (571)272-4352. The examiner can normally be reached Mon - Fri, 8:30a.m.-5:00p.m..
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Edan Orgad can be reached at 571-272-7884. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SAMUEL ROBERGE BETTENDORF/Examiner, Art Unit 2414
/EDAN ORGAD/Supervisory Patent Examiner, Art Unit 2414
Prosecution Insights