Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 16 July 2026 AD has been entered.
Response to Amendments and Arguments
Applicant’s arguments, see Remark’s pages 7 and 8, filed 16 July 2026 AD, with respect to the rejection of claims 1-20 under 35 U.S.C. 103 have been fully considered and are persuasive. Therefore, the rejection has been withdrawn. However, upon further consideration, a new ground of rejection is made in view of Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Cai et al. (US 20160337228 A1) or Cai for claims 1 and 10.
However, upon further consideration, a new ground of rejection is made in view of Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Cisco (NetFlow Configuration Guide - Using NetFlow Sampling to Select the Network Traffic to Track [Support] – Cisco) for claims 11, 12, 17, 18, and 19.
However, upon further consideration, a new ground of rejection is made in view of Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Cai et al. (US 20160337228 A1) or Cai in further view of Phaal (US 20150281085 A1) for claims 2, 3, 4, 6.
However, upon further consideration, a new ground of rejection is made in view of Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Cisco (NetFlow Configuration Guide - Using NetFlow Sampling to Select the Network Traffic to Track [Support] – Cisco) in further view of Phaal (US 20150281085 A1) for claim 16.
However, upon further consideration, a new ground of rejection is made in view of Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Cai et al. (US 20160337228 A1) or Cai in further view of Phaal (US 20150281085 A1) in further view of Castellanos Zamora et al. (US 20110022722 A1) or Castellanos Zamora for claim 5.
However, upon further consideration, a new ground of rejection is made in view of Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Cai et al. (US 20160337228 A1) or Cai in further view of Pal et al. (US 20170126725 A1) or Pal in further view of Kojima et al. (US 20150264071 A1) or Kojima for claim 7.
However, upon further consideration, a new ground of rejection is made in view of Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Cisco (NetFlow Configuration Guide - Using NetFlow Sampling to Select the Network Traffic to Track [Support] – Cisco) in further view of Pal et al. (US 20170126725 A1) or Pal in further view of Kojima et al. (US 20150264071 A1) or Kojima for claim 14.
However, upon further consideration, a new ground of rejection is made in view of Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Cai et al. (US 20160337228 A1) or Cai in further view of Pignataro et al. (US 20240323090 A1) or Pignataro for claims 8 and 9.
However, upon further consideration, a new ground of rejection is made in view of Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Cisco (NetFlow Configuration Guide - Using NetFlow Sampling to Select the Network Traffic to Track [Support] – Cisco) in further view of Pignataro et al. (US 20240323090 A1) or Pignataro for claim 15.
However, upon further consideration, a new ground of rejection is made in view of Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Cisco (NetFlow Configuration Guide - Using NetFlow Sampling to Select the Network Traffic to Track [Support] – Cisco) in further view of Pignataro et al. (US 20240323090 A1) or Pignataro in further view Kojima et al. (US 20150264071 A1) or Kojima for claim 13 and 20.
Ramaswamy et al. (US 20220158924 A1) or Ramaswamy
Ramaswamy teaches a network device for sampling traffic flows. The network device receives ingress data traffic, with the ingress data traffic comprising multiple flows, dropping a data packet in the ingress data traffic, generating at least one sampling rules with criteria defined using parameters of the dropped data packet and the parameters match packets of a targeted flow containing the dropped data packets in response to dropping the data packet in the ingress data traffic. Ramaswamy further teaches reporting the samples of data packets to at least one collector.
However, Ramaswamy fails to explicitly teach, combining a multiple sampling rules from at least one sampling rule for multiple different flows if parameters of the different flows overlap to form combined sampling rules, programming at least one sampling rule in a memory of a network device, sampling ingress data traffic received subsequent to the programming using the one or more sampling rules to obtain samples of data packets contained in the targeted flow. Ramaswamy also fails to explicitly teach a network device with multiple interfaces and each interface from the multiple interfaces associated with at least one sampling rule matching flows detected on the interface.
K et al. (US 20200344143 A1) or K
K teaches programming at least one sampling rule in a memory of a network device and sampling ingress data traffic received subsequent to the programming using the one or more sampling rules to obtain samples of data packets contained in the targeted flow. K also teaches a network device with multiple interfaces. However, K fails to explicitly teach combining a multiple sampling rules from at least one sampling rule for multiple different flows if parameters of the different flows overlap to form combined sampling rules and each interface from the multiple interfaces associated with at least one sampling rule matching flows detected on the interface.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1 and 10 are rejected under 35 U.S.C. 103 as being unpatentable over Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Cai et al. (US 20160337228 A1) or Cai.
Claim 1
Ramaswamy teaches,
A method in a network device for sampling traffic flows, the method comprising:
receiving ingress data traffic, wherein the ingress data traffic comprises a plurality of flows;
(See Ramaswamy paragraph 0045, ...packets received at the node are received by the ingress packet processing stage (e.g., packet processing stage 230). The process then determines (at 315) whether the received packet belongs to the particular packet flow for which the trace monitoring rules are specified.)
dropping a data packet in the ingress data traffic;
(See Ramaswamy paragraph 0051, ...a node in some embodiments may detect that one or more stages in the packet processing stages of the node have dropped greater than a specified threshold of packets,...)
in response to dropping the data packet in the ingress data traffic, generating one or more sampling rules whose match criteria are defined using parameters of the dropped data packet, wherein the parameters identify match packets of a flow ("targeted flow") that contains the dropped data packet;
(See Ramaswamy paragraph 0052, ...at 420, the controller dynamically generates trace monitoring rules based on the detected anomaly. Continuing with the dropped packet example above, in some embodiments, the controller may generate trace monitoring rules to trace N number of packets belonging to any flows that are processed by the particular node that is experiencing a too-large number of dropped packets.)
Shows generating sampling rules to match criteria of multiple flows
(See Ramaswamy paragraph 0005, At the flow level, trace monitoring rules in some embodiments can be specified to target a particular packet flow across nodes in the SD-WAN.)
Shows the rules may be specified for a particular flow
(See Ramaswamy paragraph 0009, ...some embodiments allow a user to select individual packet processing stages to see information (e.g., in a pop-up window) regarding the packet flow processed by the stage when the anomaly was detected as well as a description of the error or anomaly experienced on that stage. More specifically, the packet flow information includes source and destination network addresses, source and destination ports, and application ID, according to some embodiments.)
Shows the flow of the anomaly being identified by multiple parameters of source and destination network addresses, source and destination ports, and application ID
(See Ramaswamy paragraph 0057, Flow-level trace monitoring rules, in some embodiments, can specify full five-tuple match criteria and can be used to target a specific flow across one or more nodes.)
Shows the flow-level trace monitoring rules specify full five-tuple match criteria and may be used to target a specific flow
…reporting the samples of data packets to at least one collector.
(See Ramaswamy paragraph 0049, ...each packet processing stage 230-240 on a node 220 collects trace monitoring data for packets that are marked for trace monitoring and provides the data to the trace monitor 222.)
However, Ramaswamy fails to explicitly teach,
…programming the one or more sampling rules in a memory of the network device;
sampling ingress data traffic received subsequent to the programming using the one or more sampling rules to obtain samples of data packets contained in the targeted flow; and…
Nevertheless, K, in the same field of endeavor, teaches,
…programming the one or more sampling rules in a memory of the network device;…
(See K paragraph 0080, ...the trace policy engine 115 determines which flows should be traced and then causes the SDN controller to program a packet processing pipeline 120 of a switch 100 to trace packets belonging to those flows.)
sampling ingress data traffic received subsequent to the programming using the one or more… …sampling rules to obtain samples of data packets contained in the targeted flow; and…
(See K paragraph 0093, The switch 100 also copies, at the (current) flow table, content of a second field associated with the packet to the first field associated with the packet before directing the packet to a subsequent flow table of the packet processing pipeline 120 (block 620). This allows the packet to be traced at the subsequent flow table.)
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filling data of the claimed invention to combine receiving ingress data traffic, dropping a data packet in the data traffic, generating a sampling rule according to the targeted flow of the dropped packet and reporting the samples of data packets to at least one collector as disclosed by Ramaswamy with programming sample rules in a network device and sampling subsequent data traffic according to the configured rule with dropped packet as disclosed by K to increase the efficiency of the system (i.e. to prevent subsequent dropped packets).
Ramaswamy further fails to explicitly teach,
…coalescing a plurality of sampling rules from the one or more sampling rules for a plurality of different flows if parameters of the different flows overlap to form coalesced sampling rules;…
…coalesced…
Nevertheless Cai, in the same field of endeavor, teaches,
…coalescing a plurality of sampling rules from the one or more sampling rules for a plurality of different flows if parameters of the different flows overlap to form coalesced sampling rules;…
(See Cai paragraph 0065, Step S130: The switch searches a flow table corresponding to the flow table identifier for whether there is a flow entry matching the to-be-modified target information.)
Shows the switch searching for an overlapping flow entry with to-be-modified target information
(See Cai paragraph 0071, Step S150: In a case in which there is the flow entry matching the to-be-modified target information, the switch changes a match field in the matched flow entry to the new match field.)
Shows the switch forming a new combined rule with a modified match field of the matching flow entry
(See Cai paragraph 0073, …if N flow entries are to be modified, the switch needs to receive 2N modify flow entry messages from the controller, where each modify flow entry message carries a complete match field or action field, resulting in high information redundancy, low efficiency, and an overloaded interface.)
Shows multiple flows entries to be modified
…coalesced…
(See Cai paragraph 0090, Step S370: The switch performs matching between a packet and a modified flow entry, and if the packet successfully matches the modified flow entry, performs an operation included in the successfully matched entry on the packet.)
Shows the switch performing an operation with matching packet and the modified or coalesced flow entry
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filling data of the claimed invention to combine receiving ingress data traffic, dropping a data packet in the data traffic, generating a sampling rule according to the targeted flow of the dropped packet and reporting the samples of data packets to at least one collector as disclosed by Ramaswamy with combing multiple sampling rules from at least one sample rule for multiple different flows if parameters of different flows overlap to form combined sample rules as disclosed by Cai to increase the efficiency of the system (i.e. to reduce the number of sampling rules configured in a flow table).
Claim 10
Ramaswamy fails to explicitly teach limitations of claim 10. Nevertheless, K, in the same field of endeavor, teaches,
The method of claim 1, wherein reporting the samples of data packets includes generating Postcard Telemetry packets that comprise the samples of data packets.
(See K paragraph 0031, A postcard is a truncated copy of the packet's header, augmented with an indication of the matching flow entry, an indication of the switch, and an indication of the output port. A collector module collects such postcards and is able to trace the packet based on an analysis of the collected postcards.)
The motivation to combine Ramaswamy, K, and Cai in the dependent claim consists of the same motivation as stated in claim 1.
Claims 11, 12, 17, 18, and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Cisco (NetFlow Configuration Guide - Using NetFlow Sampling to Select the Network Traffic to Track [Support] – Cisco).
Claim 11
Ramaswamy teaches,
A network device comprising: one or more computer processors; a memory;…
(See Ramaswamy paragraph 0086, ...microprocessors, storage and memory that store computer program instructions in a machine-readable or computer-readable medium (alternatively referred to as computer-readable storage media, machine-readable media, or machine-readable storage media).)
…and a computer-readable storage device comprising instructions for controlling the one or more computer processors to:
(See Ramaswamy paragraph 0086, The computer-readable media may store a computer program that is executable by at least one processing unit and includes sets of instructions for performing various operations.)
receive ingress data traffic, wherein the ingress data traffic comprises a plurality of flows;
(See Ramaswamy paragraph 0045, ...packets received at the node are received by the ingress packet processing stage (e.g., packet processing stage 230). The process then determines (at 315) whether the received packet belongs to the particular packet flow for which the trace monitoring rules are specified.)
drop a data packet in the ingress data traffic;
(See Ramaswamy paragraph 0051, ...a node in some embodiments may detect that one or more stages in the packet processing stages of the node have dropped greater than a specified threshold of packets,...)
subsequent to the dropped data packet, trigger sampling a flow ("targeted flow") that contains the dropped data packet, wherein parameters of the dropped data packet identify the targeted flow,…
(See Ramaswamy paragraph 0052, ...at 420, the controller dynamically generates trace monitoring rules based on the detected anomaly. Continuing with the dropped packet example above, in some embodiments, the controller may generate trace monitoring rules to trace N number of packets belonging to any flows that are processed by the particular node that is experiencing a too-large number of dropped packets.)
Shows generating sampling rules to match criteria of multiple flows
(See Ramaswamy paragraph 0005, At the flow level, trace monitoring rules in some embodiments can be specified to target a particular packet flow across nodes in the SD-WAN.)
Shows the rules may be specified for a particular flow
(See Ramaswamy paragraph 0009, ...some embodiments allow a user to select individual packet processing stages to see information (e.g., in a pop-up window) regarding the packet flow processed by the stage when the anomaly was detected as well as a description of the error or anomaly experienced on that stage. More specifically, the packet flow information includes source and destination network addresses, source and destination ports, and application ID, according to some embodiments.)
Shows the flow of the anomaly being identified by multiple parameters of source and destination network addresses, source and destination ports, and application ID
(See Ramaswamy paragraph 0057, Flow-level trace monitoring rules, in some embodiments, can specify full five-tuple match criteria and can be used to target a specific flow across one or more nodes.)
Shows the flow-level trace monitoring rules specify full five-tuple match criteria and may be used to target a specific flow
…transmit the sampled data packets of the targeted flow to at least one collector.
(See Ramaswamy paragraph 0049, ...each packet processing stage 230-240 on a node 220 collects trace monitoring data for packets that are marked for trace monitoring and provides the data to the trace monitor 222.)
However, Ramaswamy fails to explicitly teach,
…a plurality of interfaces;…
…wherein all data packets of the targeted flow are sampled; and
Nevertheless, K, in the same field of endeavor, teaches,
…a plurality of interfaces;…
(See K paragraph 0029, Typical electronic devices also include a set or one or more physical network interface(s) (NI(s)) to establish network connections (to transmit and/or receive code and/or data using propagating signals) with other electronic devices.)
Shows the electronic device possesses multiple network interfaces
…wherein all data packets of the targeted flow are sampled; and
(See K paragraph 0080, ...the trace policy engine 115 determines which flows should be traced and then causes the SDN controller to program a packet processing pipeline 120 of a switch 100 to trace packets belonging to those flows.)
Shows all the packets according to the determination of the policy engine to be traced or sampled
The motivation to combine Ramaswamy and K in the independent claim consists of the same motivation as stated in claim 1.
Ramaswamy fails to explicitly teach,
…wherein each interface from the plurality of interfaces is associated with at least one sampling rule that matches flows detected on the interface.
Nevertheless, Cisco, in the same field of endeavor, teaches,
…wherein each interface from the plurality of interfaces is associated with at least one sampling rule that matches flows detected on the interface.
(See Cisco First and second paragraphs under, “Random Sampled NetFlow The NetFlow Sampler”, A NetFlow sampler map defines a set of properties (such as the sampling rate and NetFlow sampler name) for NetFlow sampling. Each NetFlow sampler map can be applied to one or many subinterfaces as well as physical interfaces. You can define up to eight NetFlow sampler maps.
For example, you can create a NetFlow sampler map named mysampler1 with the following properties: random sampling mode and a sampling rate of 1 out of 100 packets. This NetFlow sampler map can be applied to any number of subinterfaces, each of which would refer to mysampler1 to perform NetFlow sampling. Traffic from these subinterfaces is merged (from a sampling point of view).)
Shows multiple sampling rules for multiple interfaces
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filling data of the claimed invention to combine receiving ingress data traffic, dropping a data packet in the data traffic, generating a sampling rule according to the targeted flow of the dropped packet and reporting the samples of data packets to at least one collector as disclosed by Ramaswamy with each interface from multiple interfaces associated with at least one sampling rule matching flows detected on the interface as disclosed by Cisco to increase the efficiency of the system (i.e. to increase the flexibility of a network device to filter and control flow traffic).
Claim 12
Ramaswamy teaches,
The network device of claim 11, wherein the computer-readable storage device further comprises instructions for controlling the one or more computer processors to:
(See Ramaswamy paragraph 0086, The computer-readable media may store a computer program that is executable by at least one processing unit and includes sets of instructions for performing various operations.)
…program the one or more sampling rules in the memory of the network device to sample the data packets of the targeted flow.
(See Ramaswamy paragraph 0181, The packet and associated information and metadata (e.g., a domain name, time, location, direction, origin, attack type estimate, rate estimates, etc.) may be recorded for statistics purposes, packet and associated information and metadata may be logged and/or captured, and the packet and associated information and metadata may be stored in MEMORY-STORE 1532.)
generate one or more sampling rules that match on data packets of the targeted flow in response to the dropped data packet; and…
(See Ramaswamy paragraph 0052, ...at 420, the controller dynamically generates trace monitoring rules based on the detected anomaly. Continuing with the dropped packet example above, in some embodiments, the controller may generate trace monitoring rules to trace N number of packets belonging to any flows that are processed by the particular node that is experiencing a too-large number of dropped packets.)
However, Ramaswamy fails to explicitly teach,
…program the one or more sampling rules in the memory of the network device to sample the data packets of the targeted flow.
Nevertheless, K, in the same field of endeavor, teaches,
…program the one or more sampling rules in the memory of the network device to sample the data packets of the targeted flow.
(See K paragraph 0080, ...the trace policy engine 115 determines which flows should be traced and then causes the SDN controller to program a packet processing pipeline 120 of a switch 100 to trace packets belonging to those flows.)
The motivation to combine Ramaswamy, K, and Cisco in the independent claim consists of the same motivation as stated in claim 11.
Claim 18
Ramaswamy teaches,
A non-transitory computer-readable storage device in a network device, the non- transitory computer-readable storage device having stored thereon computer executable instructions, which when executed, cause the network device to:
(See Ramaswamy paragraph 0086, The computer-readable media may store a computer program that is executable by at least one processing unit and includes sets of instructions for performing various operations.)
receive ingress data traffic, wherein the ingress data traffic comprises a plurality of flows;
(See Ramaswamy paragraph 0045, ...packets received at the node are received by the ingress packet processing stage (e.g., packet processing stage 230). The process then determines (at 315) whether the received packet belongs to the particular packet flow for which the trace monitoring rules are specified.)
drop a data packet in the ingress data traffic;
(See Ramaswamy paragraph 0051, ...a node in some embodiments may detect that one or more stages in the packet processing stages of the node have dropped greater than a specified threshold of packets,...)
subsequent to the dropped data packet, trigger sampling a flow ("targeted flow") that contains the dropped data packet, wherein parameters of the dropped data packet identify the targeted flow,…
(See Ramaswamy paragraph 0052, ...at 420, the controller dynamically generates trace monitoring rules based on the detected anomaly. Continuing with the dropped packet example above, in some embodiments, the controller may generate trace monitoring rules to trace N number of packets belonging to any flows that are processed by the particular node that is experiencing a too-large number of dropped packets.)
Shows generating sampling rules to match criteria of multiple flows
(See Ramaswamy paragraph 0005, At the flow level, trace monitoring rules in some embodiments can be specified to target a particular packet flow across nodes in the SD-WAN.)
Shows the rules may be specified for a particular flow
(See Ramaswamy paragraph 0009, ...some embodiments allow a user to select individual packet processing stages to see information (e.g., in a pop-up window) regarding the packet flow processed by the stage when the anomaly was detected as well as a description of the error or anomaly experienced on that stage. More specifically, the packet flow information includes source and destination network addresses, source and destination ports, and application ID, according to some embodiments.)
Shows the flow of the anomaly being identified by multiple parameters of source and destination network addresses, source and destination ports, and application ID
(See Ramaswamy paragraph 0057, Flow-level trace monitoring rules, in some embodiments, can specify full five-tuple match criteria and can be used to target a specific flow across one or more nodes.)
Shows the flow-level trace monitoring rules specify full five-tuple match criteria and may be used to target a specific flow
…and transmit the sampled data packets of the targeted flow to at least one collector.
(See Ramaswamy paragraph 0049, ...each packet processing stage 230-240 on a node 220 collects trace monitoring data for packets that are marked for trace monitoring and provides the data to the trace monitor 222.)
However, Ramaswamy fails to explicitly teach,
…wherein all data packets of the targeted flow are sampled;…
…wherein the network device comprises a plurality of interfaces,..
Nevertheless, K, in the same field of endeavor, teaches,
…wherein all data packets of the targeted flow are sampled;…
(See K paragraph 0080, ...the trace policy engine 115 determines which flows should be traced and then causes the SDN controller to program a packet processing pipeline 120 of a switch 100 to trace packets belonging to those flows.)
Shows all the packets according to the determination of the policy engine to be traced or sampled
…wherein the network device comprises a plurality of interfaces,..
(See K paragraph 0029, Typical electronic devices also include a set or one or more physical network interface(s) (NI(s)) to establish network connections (to transmit and/or receive code and/or data using propagating signals) with other electronic devices.)
Shows the electronic device possesses multiple network interfaces
The motivation to combine Ramaswamy and K in the independent claim consists of the same motivation as stated in claim 1.
Ramaswamy fails to explicitly teach,
…and wherein each interface from the plurality of interfaces is associated with at least one sampling rule that matches flows detected on the interface.
Nevertheless, Cisco, in the same field of endeavor, teaches,
…and wherein each interface from the plurality of interfaces is associated with at least one sampling rule that matches flows detected on the interface.
(See Cisco First and second paragraphs under, “Random Sampled NetFlow The NetFlow Sampler”, A NetFlow sampler map defines a set of properties (such as the sampling rate and NetFlow sampler name) for NetFlow sampling. Each NetFlow sampler map can be applied to one or many subinterfaces as well as physical interfaces. You can define up to eight NetFlow sampler maps.
For example, you can create a NetFlow sampler map named mysampler1 with the following properties: random sampling mode and a sampling rate of 1 out of 100 packets. This NetFlow sampler map can be applied to any number of subinterfaces, each of which would refer to mysampler1 to perform NetFlow sampling. Traffic from these subinterfaces is merged (from a sampling point of view).)
Shows multiple sampling rules for multiple interfaces
The motivation to combine Ramaswamy and Cisco consists of the same motivation as stated in claim 11.
Claim 19
Ramaswamy teaches limitations of claim 19 as stated in claim 12. However, Ramaswamy fails to explicitly teach limitations of claim 19 as stated in claim 12. Nevertheless, K, in the same field of endeavor, teaches limitations of claim 19 as stated in claim 12. The motivation to combine Ramaswamy, K, and Cisco in dependent claim consists of the same motivation as stated in claim 11.
Claim 17
Ramaswamy teaches,
The network device of claim 11, wherein the computer-readable storage device further comprises instructions for controlling the one or more computer processors…
(See Ramaswamy paragraph 0086, The computer-readable media may store a computer program that is executable by at least one processing unit and includes sets of instructions for performing various operations.)
However, K, in the same field of endeavor, teaches limitations of claim 17 as stated in claim 10. The motivation to combine Ramaswamy, K, and Cisco in dependent claim consists of the same motivation as stated in claim 11.
Claims 2, 3, 4, 6 are rejected under 35 U.S.C. 103 as being unpatentable over Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Cai et al. (US 20160337228 A1) or Cai in further view of Phaal (US 20150281085 A1).
Claim 2
Ramaswamy fails to explicitly teach limitations of claim 2. Nevertheless, Phaal, in the same field of endeavor, teaches,
The method of claim 1, wherein prior to the network device dropping the dropped data packet, data packets in the targeted flow were at most randomly sampled.
(See paragraph Phaal 0022, The packet sampler of switching/routing module 260 is configured to randomly sample packets that transit the module, and extracts information from the sampled packets.)
Shows randomly sampled targeted flow
(See paragraph Phaal 0028, The table of the network device may be made up of a number of OpenFlow entries, each of the entries consists of a filter configured to match flows and an action configured to drop, rate limit, replicate packets, and/or alter paths taken by the packets when the flows match the filter. )
Shows the dropping of packets according to a filter on the randomly sampled targeted flow
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filling data of the claimed invention to combine receiving ingress data traffic, dropping a data packet in the data traffic, generating a sampling rule according to the targeted flow of the dropped packet and reporting the samples of data packets to at least one collector as disclosed by Ramaswamy with randomly sampling the targeted traffic prior to dropping the data packet as disclosed by Phaal to increase the efficiency of the system (i.e. to reduce the number of sampled packets in the targeted traffic).
Claim 3
Ramaswamy fails to explicitly teach limitations of claim 3. Nevertheless, Phaal, in the same field of endeavor, teaches,
The method of claim 1, further comprising deleting the one or more sampling rules at a time when the targeted flow is deemed to be no longer experiencing dropped packets.
(See Phaal paragraph 0031, Once the rule is received by the switch, the traffic is dropped and no longer reaches the intended victim. The controller later removes the rule, either based on a timeout, or because the traffic is no longer being observed by analytics software.)
The motivation to combine Ramaswamy, K, Cai, and Phaal in the dependent claim consists of the same motivation as stated in claim 2.
Claim 4
Ramaswamy fails to explicitly teach limitations of claim 4. Nevertheless, Phaal, in the same field of endeavor, teaches,
The method of claim 3, wherein the targeted flow is deemed to be no longer experiencing dropped packets when the targeted flow has not exhibited a packet drop for a predetermined period of time.
(See Phaal paragraph 0031, Once the rule is received by the switch, the traffic is dropped and no longer reaches the intended victim. The controller later removes the rule, either based on a timeout, or because the traffic is no longer being observed by analytics software.)
The motivation to combine Ramaswamy, K, Cai, and Phaal in the dependent claim consists of the same motivation as stated in claim 2.
Claim 6
Ramaswamy fails to explicitly teach limitations of claim 6. Nevertheless, Phaal, in the same field of endeavor, teaches,
The method of claim 1, further comprising distributing the one or more sampling rules to other network devices in the network, wherein the other network devices sample their respective ingress data traffic using the one or more sampling rules to identify data packets in the targeted flow…
(See Phaal paragraph 0030, When a large flow is detected by the controller it creates a filter matching the specific destination address and protocol attributes of the detected large flow and uses OpenFlow to send a rule to a switch reporting the traffic in order to match and drop the traffic associated with the DDoS attack,...)
The motivation to combine Ramaswamy, K, Cai, and Phaal in the dependent claim consists of the same motivation as stated in claim 2.
K teaches,
…and report on their respective identified data packets to the collector.
(See K paragraph 0031, One conventional technique for troubleshooting packet processing in an SDN network sends a small “postcard” every time a packet visits a switch. A postcard is a truncated copy of the packet's header, augmented with an indication of the matching flow entry, an indication of the switch, and an indication of the output port. A collector module collects such postcards and is able to trace the packet based on an analysis of the collected postcards.)
The motivation to combine Ramaswamy, K, Cai, and Phaal in the dependent claim consists of the same motivation as stated in claim 2.
Claim 16 is rejected under 35 U.S.C. 103 as being unpatentable over Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Cisco (NetFlow Configuration Guide - Using NetFlow Sampling to Select the Network Traffic to Track [Support] – Cisco) in further view of Phaal (US 20150281085 A1).
Claim 16
Ramaswamy teaches,
The network device of claim 11, wherein the computer-readable storage device further comprises instructions for controlling the one or more computer processors to…
(See Ramaswamy paragraph 0086, The computer-readable media may store a computer program that is executable by at least one processing unit and includes sets of instructions for performing various operations.)
Ramaswamy fails to explicitly teach limitations of claim 16. Nevertheless, Phaal, in the same field of endeavor, teaches limitations of claim 16 as stated in claim 4. The motivation to combine Ramaswamy, K, Cisco and Phaal in the dependent claim consists of the same motivation as stated in claim 11.
Claim 5 is rejected under 35 U.S.C. 103 as being unpatentable over Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Cai et al. (US 20160337228 A1) or Cai in further view of Phaal (US 20150281085 A1) in further view of Castellanos Zamora et al. (US 20110022722 A1) or Castellanos Zamora.
Claim 5
Ramaswamy fails to explicitly teach limitations of claim 5. Nevertheless, Phaal, in the same field of endeavor, teaches,
The method of claim 3, further comprising, before deleting the one or more sampling rules,… …that the targeted flow is deemed to be no longer experiencing dropped packets.
(See Phaal paragraph 0031, Once the rule is received by the switch, the traffic is dropped and no longer reaches the intended victim. The controller later removes the rule, either based on a timeout, or because the traffic is no longer being observed by analytics software.)
Shows the targeted flow fails to experience dropped packets
The motivation to combine Ramaswamy, K, Cai, and Phaal in the dependent claim consists of the same motivation as stated in claim 2.
Castellanos Zamora teaches,
…delaying for a period of time after a point in time…
(See Castellanos Zamora, paragraph 0052, Rather than implement the delay timer at the PCRF, the PCRF may request that the PCEF initiate the timer and remove the PCC rules for the existing filter information upon expiry of the timer. This approach may indeed be optimal where a single message from the PCRF is used to install both new rules and trigger the delayed removal of the existing rules.)
Shows the delaying of removing an existing rule
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filling data of the claimed invention to combine receiving ingress data traffic, dropping a data packet in the data traffic, generating a sampling rule according to the targeted flow of the dropped packet and reporting the samples of data packets to at least one collector as disclosed by Ramaswamy with delaying the removal of a rule as disclosed by Castellanos Zamora to increase the efficiency of the system (i.e. to reduce the probability of the dropped packets).
Claim 7 is rejected under 35 U.S.C. 103 as being unpatentable over Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Cai et al. (US 20160337228 A1) or Cai in further view of Pal et al. (US 20170126725 A1) or Pal in further view of Kojima et al. (US 20150264071 A1) or Kojima.
Claim 7
Ramaswamy fails to explicitly teach limitations of claim 7. Nevertheless, Pal, in the same field of endeavor, teaches,
The method of claim 6, wherein distributing… …includes sending… …to a network management system,
wherein the network management system distributes the one or more… …to the other network devices.
(See Kojima paragraph 0018, The analysis apparatus 1 includes an analysis unit 12 which receives communication data (sample data) sampled by the sampling devices in the monitoring-target system 3, and analyzes the possibility of a security incident by using the sample data. The analysis apparatus 1 also includes a sampling rule management unit 11. As a result of an analysis of the sample data by the analysis unit 12, if it is determined that there is a possibility of occurrence of a security incident, the sampling rule management unit 11 instructs, in accordance with the analysis result, the sampling devices 2 to change sampling rules for acquiring communication data and transmitting the communication data to the analysis apparatus 1.)
Shows transmitting data to network management system and the network management system distributing sampling data to other network devices
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filling data of the claimed invention to combine receiving ingress data traffic, dropping a data packet in the data traffic, generating a sampling rule according to the targeted flow of the dropped packet and reporting the samples of data packets to at least one collector as disclosed by Ramaswamy with transmitting sampling data to a network management system and the network management system distributing the sampling data to other devices as disclosed by Kojima to increase the efficiency of the system (i.e. to reduce the number of steps required to distribute data across a network).
Pal teaches,
…the one or more sampling rules…
…the one or more sampling rules…
…sampling rules…
(See Pal paragraph 0059, To adjust the sampling policy, offline policy manager 422 may itself change the sampling policy and then send a copy of the changed sampling policy to online policy enforcer 421.)
Shows the transmission of a sampling rule from one device to another device
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filling data of the claimed invention to combine receiving ingress data traffic, dropping a data packet in the data traffic, generating a sampling rule according to the targeted flow of the dropped packet and reporting the samples of data packets to at least one collector as disclosed by Ramaswamy with transmitting sampling rule from one device to another device as disclosed by Pal to increase the security of the system (i.e. to increase protection against malicious packets entering a network).
Claim 14 is rejected under 35 U.S.C. 103 as being unpatentable over Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Cisco (NetFlow Configuration Guide - Using NetFlow Sampling to Select the Network Traffic to Track [Support] – Cisco) in further view of Pal et al. (US 20170126725 A1) or Pal in further view of Kojima et al. (US 20150264071 A1) or Kojima.
Claim 14
Ramaswamy teaches,
The network device of claim 12, wherein the computer-readable storage device further comprises instructions for controlling the one or more computer processors…
(See Ramaswamy paragraph 0086, The computer-readable media may store a computer program that is executable by at least one processing unit and includes sets of instructions for performing various operations.)
However, Ramaswamy fails to explicitly teach,
…to send the one or more sampling rules to a network management system, wherein the network management system distributes the one or more sampling rules to the other network devices in a data network.
Nevertheless, Pal and Kojima, in the same field of endeavor, teach limitations of claim 14 as stated in claim 7. The motivation to combine Ramaswamy, K, Cai, Pal, and Kojima in the dependent claim consists of the same motivation as stated in claim 7.
Claims 8 and 9 are rejected under 35 U.S.C. 103 as being unpatentable over Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Cai et al. (US 20160337228 A1) or Cai in further view of Pignataro et al. (US 20240323090 A1) or Pignataro.
Claim 8
Ramaswamy fails to explicitly teach limitations of claim 8. Nevertheless, Pignataro, in the same field of endeavor, teaches,
The method of claim 6, wherein distributing the one or more sampling rules includes the network device sending the one or more sampling rules to the other network devices in the network.
(See Pignataro paragraph 0068, Upon defining the criteria, the sampling policy logic 302 can transmit the criteria to both a power consumption profiling logic 303 (step 2A), and to one or more configuration tools 304 (step 2B) that can manage the different sampling configurations on the various elements of the network devices within the multi-layer topology 202.)
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filling data of the claimed invention to combine receiving ingress data traffic, dropping a data packet in the data traffic, generating a sampling rule according to the targeted flow of the dropped packet and reporting the samples of data packets to at least one collector as disclosed by Ramaswamy with transmitting sampling rule from one device to other devices in a network as disclosed by Pignataro to increase the efficiency of the system (i.e. to increase the number of network devices utilizing a sampling rule for reducing packet loss).
Claim 9
Ramaswamy fails to explicitly teach limitations of claim 9. Nevertheless, Pignataro, in the same field of endeavor, teaches,
The method of claim 6, wherein the one or more sampling rules are distributed to network devices on a path of the targeted flow.
(See Pignataro paragraph 0068, As a result, in many embodiments, the different sampling configurations within the defined criteria are transmitted or pushed to all of the elements affected, including within the sustainability aggregation entity 201 itself, and the one or more observability elements 315 (step 3). In further embodiments, the sampling can be done by a specific device and transmitted to each network device on command or as needed.)
The motivation to combine Ramaswamy, K, Cai, and Pignataro in the dependent claim consists of the same motivation as stated in claim 8.
Claim 15 is rejected under 35 U.S.C. 103 as being unpatentable over Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Cisco (NetFlow Configuration Guide - Using NetFlow Sampling to Select the Network Traffic to Track [Support] – Cisco) in further view of Pignataro et al. (US 20240323090 A1) or Pignataro.
Claim 15
Ramaswamy teaches,
The network device of claim 12, wherein the computer-readable storage device further comprises instructions for controlling the one or more computer processors
(See Ramaswamy paragraph 0086, The computer-readable media may store a computer program that is executable by at least one processing unit and includes sets of instructions for performing various operations.)
However, Ramaswamy fails to explicitly teach,
…to send the one or more sampling rules to the other network devices in a data network.
Nevertheless, Pignataro, in the same field of endeavor, teaches limitations of claim 15 as stated in claim 8.
The motivation to combine Ramaswamy, K, Cai, and Pignataro in the dependent claim consists of the same motivation as stated in claim 8.
Claims 13 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Ramaswamy et al. (US 20220158924 A1) or Ramaswamy in view of K et al. (US 20200344143 A1) or K in further view of Cisco (NetFlow Configuration Guide - Using NetFlow Sampling to Select the Network Traffic to Track [Support] – Cisco) in further view of Pignataro et al. (US 20240323090 A1) or Pignataro in further view Kojima et al. (US 20150264071 A1) or Kojima.
Claim 13
Ramaswamy teaches,
The network device of claim 12, wherein the computer-readable storage device further comprises instructions for controlling the one or more computer processors
(See Ramaswamy paragraph 0086, The computer-readable media may store a computer program that is executable by at least one processing unit and includes sets of instructions for performing various operations.)
However, Ramaswamy fails to explicitly teach,
…to distribute the one or more sampling rules to other network devices in a data network,…
Nevertheless, Piganataro, in the same field of endeavor, teaches,
…to distribute the one or more sampling rules to other network devices in a data network,…
(See Pignataro paragraph 0068, Upon defining the criteria, the sampling policy logic 302 can transmit the criteria to both a power consumption profiling logic 303 (step 2A), and to one or more configuration tools 304 (step 2B) that can manage the different sampling configurations on the various elements of the network devices within the multi-layer topology 202.)
The motivation to combine Ramaswamy, K, Cisco, and Pignataro in the dependent claim consists of the same motivation as stated in claim 11.
However, Ramaswamy fails to explicitly teach,
…wherein network devices on a path of the targeted flow sample the data packets of the targeted flow and transmit the sampled data packets to the at least one collector.
Nevertheless, Kojima, in the same field of endeavor, teaches,
…wherein network devices on a path of the targeted flow sample the data packets of the targeted flow and transmit the sampled data packets to the at least one collector.
(See Kojima paragraph 0018, The analysis apparatus 1 includes an analysis unit 12 which receives communication data (sample data) sampled by the sampling devices in the monitoring-target system 3, and analyzes the possibility of a security incident by using the sample data. The analysis apparatus 1 also includes a sampling rule management unit 11. As a result of an analysis of the sample data by the analysis unit 12, if it is determined that there is a possibility of occurrence of a security incident, the sampling rule management unit 11 instructs, in accordance with the analysis result, the sampling devices 2 to change sampling rules for acquiring communication data and transmitting the communication data to the analysis apparatus 1.)
The motivation to combine Ramaswamy, K, Cisco, and Kojima in the dependent claim consists of the same motivation as stated in claim 11.
Claim 20
Ramaswamy teaches,
The non-transitory computer-readable storage device of claim 18, wherein the computer executable instructions, which when executed, further cause the network device to distribute…
(See Ramaswamy paragraph 0086, The computer-readable media may store a computer program that is executable by at least one processing unit and includes sets of instructions for performing various operations.)
However, Ramaswamy fails to explicitly teach limitations of claim 20 as stated in claim 13. Nevertheless, Pignataro and Kojima, in the same field of endeavor, teach limitations of claim 20 as stated in claim 13. The motivation to combine Ramaswamy, K, Cisco and Pignataro in the dependent claim consists of the same motivation as stated in claim 11. The motivation to combine Ramaswamy, K, Cisco, and Kojima in the dependent claim consists of the same motivation as stated in claim 11.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant’s disclosure.
Wang et al. (US 8619766 B2) or Wang teaches a device receiving a packet and processing the packet by classifying the packet with an evolving rule.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SAMUEL ROBERGE BETTENDORF whose telephone number is (571)272-4352. The examiner can normally be reached Mon - Fri, 8:30a.m.-5:00p.m..
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Edan Orgad can be reached at 571-272-7884. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SAMUEL ROBERGE BETTENDORF/Examiner, Art Unit 2414
/EDAN ORGAD/Supervisory Patent Examiner, Art Unit 2414
Prosecution Insights