DCT

2:16-cv-00230

Packet Intelligence LLC v. NetScout Systems Inc

Log In

I. Executive Summary and Procedural Information

  • Parties & Counsel:
  • Case Identification: 2:16-cv-00230, E.D. Tex., 03/15/2016
  • Venue Allegations: Plaintiff alleges venue is proper in the Eastern District of Texas because Defendants conduct regular business in the district, have sold accused products to customers in the district, and maintain corporate offices in Plano, Texas.
  • Core Dispute: Plaintiff alleges that Defendant’s GeoProbe family of network monitoring products infringes five patents related to the real-time analysis and classification of network traffic flows.
  • Technical Context: The technology at issue addresses deep packet inspection and stateful analysis of network communications, which is a critical function for operators of large computer networks for performance monitoring and management.
  • Key Procedural History: The complaint states that all asserted patents were previously asserted by Plaintiff against Huawei Device USA Inc. (dismissed by agreement in 2014) and Cisco Systems Inc. (dismissed by agreement in 2015). A case asserting the same patents against Sandvine Corporation was pending at the time of this complaint's filing. This history suggests an ongoing licensing or enforcement campaign for this patent portfolio.

Case Timeline

Date Event
1999-06-30 Earliest Priority Date for all Patents-in-Suit
2003-11-18 U.S. Patent No. 6,651,099 Issues
2003-12-16 U.S. Patent No. 6,665,725 Issues
2004-08-03 U.S. Patent No. 6,771,646 Issues
2005-01-04 U.S. Patent No. 6,839,751 Issues
2005-10-11 U.S. Patent No. 6,954,789 Issues
2013-03-12 Plaintiff files suit against Huawei asserting the patents-in-suit
2014-03-24 Plaintiff files suit against Cisco asserting the patents-in-suit
2015-07-14 NetScout completes acquisition of Danaher's communication business, including Tektronix
2016-02-17 Plaintiff files suit against Sandvine asserting the patents-in-suit
2016-03-15 Complaint Filed

II. Technology and Patent(s)-in-Suit Analysis

U.S. Patent No. 6,651,099 - "Method and Apparatus for Monitoring Traffic in a Network"

The Invention Explained

  • Problem Addressed: The patent’s background section describes the limitations of prior art network monitors, which often relied on inefficient log file analysis or were limited to network-layer information. These earlier methods struggled to identify and classify "conversational flows"—the complete sequence of packets related to a single user activity—especially when those flows involved multiple, disjointed network connections (e.g., for setting up and then using a service). (’099 Patent, col. 1:47-col. 3:51).
  • The Patented Solution: The invention is a monitor that examines packets in real time at a connection point in a network. It performs parsing operations to extract key information from a packet, creates a "flow-entry" or signature for a conversational flow, and stores it in a database. For subsequent packets, it performs a lookup to see if the packet belongs to a known flow. Crucially, the monitor maintains the "state" of the flow, allowing it to perform state-specific processing to ultimately identify the application program associated with the entire conversational flow. (’099 Patent, Abstract; Fig. 3).
  • Technical Importance: This approach provided a method for real-time, application-level visibility into network traffic, which was becoming essential for managing the performance and security of increasingly complex networks. (Compl. ¶43).

Key Claims at a Glance

  • The complaint asserts at least independent claim 1 (Compl. ¶69).
  • The essential elements of claim 1, an apparatus claim, include:
    • A packet-buffer memory to accept a packet.
    • A parsing/extraction operations memory to store a database of parsing operations.
    • A parser subsystem configured to examine the packet, extract selected portions, and form a function of those portions to identify a "conversational flow-sequence."
    • A memory storing a flow-entry database.
    • A lookup engine to determine if the packet belongs to a known flow.
    • A state patterns/operations memory to store predefined state transition patterns.
    • A protocol/state identification mechanism to determine the protocol and state of the flow.
    • A state processor configured to carry out state operations to further the process of identifying the associated application program.
  • The complaint does not explicitly reserve the right to assert dependent claims for this patent.

U.S. Patent No. 6,665,725 - "Processing Protocol Specific Information in Packets Specified by a Protocol Description Language"

The Invention Explained

  • Problem Addressed: The patent notes that network monitors with fixed or hard-coded logic for parsing different network protocols are difficult to adapt. As new protocols and applications proliferate, a monitor with inflexible parsing logic quickly becomes obsolete. (’725 Patent, col. 3:64-col. 4:4).
  • The Patented Solution: The invention discloses a method where the rules for monitoring traffic are defined in a high-level “protocol description language” (PDL). These PDL files specify how to recognize packet headers, what information to extract, and what state operations to perform for various protocols. A compiler then translates these human-readable descriptions into internal data structures that the network monitor uses for its real-time analysis. (’725 Patent, Abstract; Fig. 4).
  • Technical Importance: This use of a descriptive language and compiler makes the network monitor flexible and adaptable, allowing it to be updated to handle new and custom protocols without requiring fundamental changes to its hardware or core software. (Compl. ¶43).

Key Claims at a Glance

  • The complaint asserts at least independent claim 17 (Compl. ¶77).
  • The essential elements of claim 17, an apparatus claim, include:
    • A memory configured to store a database of parsing/extraction operations that have been "compiled from one or more protocol descriptions."
    • A parser subsystem configured to examine a packet and extract identifying information from it based on the operations retrieved from the memory.
    • An analyzer subsystem coupled to the parser and configured to identify an application program associated with the packet based on the extracted information.
  • The complaint does not explicitly reserve the right to assert dependent claims for this patent.

U.S. Patent No. 6,771,646 - "Associative Cache Structure for Lookups and Updates of Flow Records in a Network Monitor"

  • Patent Identification: U.S. Patent No. 6,771,646, “Associative Cache Structure for Lookups and Updates of Flow Records in a Network Monitor,” issued August 3, 2004 (Compl. ¶37).
  • Technology Synopsis: The patent addresses the challenge of performing very fast lookups of flow records in a high-speed network monitor. It proposes an associative cache structure, using content-addressable memories (CAMs), that employs a true least-recently-used (LRU) replacement policy to maximize the probability that the record for an incoming packet is already in the cache, thereby speeding up processing. (’646 Patent, Abstract).
  • Asserted Claims: At least claim 7 (Compl. ¶85).
  • Accused Features: The accused products are alleged to use a lookup engine to compare packet information against a flow-entry database memory, which is a core function addressed by the patent’s cache structure. (Compl. ¶62).

U.S. Patent No. 6,839,751 - "Re-Using Information from Data Transactions for Maintaining Statistics in Network Monitoring"

  • Patent Identification: U.S. Patent No. 6,839,751, “Re-Using Information from Data Transactions for Maintaining Statistics in Network Monitoring,” issued January 4, 2005 (Compl. ¶39).
  • Technology Synopsis: This patent focuses on the collection and maintenance of statistical measures for conversational flows. By processing each packet of a flow and updating statistics stored in the flow-entry (such as packet counts and timestamps), the invention enables the calculation of performance metrics, including quality of service metrics. (’751 Patent, Abstract).
  • Asserted Claims: At least claim 17 (Compl. ¶93).
  • Accused Features: The accused products are alleged to create and store flow records that include data such as packet counts, byte counts, and timing information, which corresponds to the claimed method of maintaining statistics. (Compl. ¶61, 62).

U.S. Patent No. 6,954,789 - "Method and Apparatus for Monitoring Traffic in a Network"

  • Patent Identification: U.S. Patent No. 6,954,789, “Method and Apparatus for Monitoring Traffic in a Network,” issued October 11, 2005 (Compl. ¶41).
  • Technology Synopsis: This patent is in the same family as the ’099 patent and covers similar technological ground. It describes a method and apparatus for monitoring network traffic in real time by creating, storing, and looking up flow-entries for conversational flows in order to maintain state and identify the associated application program. (’789 Patent, Abstract).
  • Asserted Claims: At least claim 19 (Compl. ¶100).
  • Accused Features: The general network monitoring architecture of the accused products, which involves creating flow records and using them to classify traffic, is alleged to infringe. (Compl. ¶57-67).

III. The Accused Instrumentality

Product Identification

The accused instrumentalities are a family of computer network platforms sold under the "GeoProbe" name, including the GeoProbe G10 (a hardware device), GeoBlade (a modular hardware platform), and GeoSoft RAN (a virtual software monitor) (Compl. ¶51-54). The complaint also implicates associated software technologies, notably Deep Packet Classification (“DPC”) and the IRIS Suite of applications, such as the Iris Session Analyzer (Compl. ¶55, 57).

Functionality and Market Context

The accused products are network monitoring solutions designed to provide network operators with comprehensive data collection and analysis across various network technologies (Compl. ¶51). A core function is "Deep Packet Classification," which the complaint alleges is used to "conclusively classify the application or protocol contained" within network packets in real-time (Compl. ¶55, 65). The system is alleged to create "flow-entry" records using "5-Tuple" information (source/destination IP addresses, source/destination ports, and protocol) to identify conversational flows (Compl. ¶61). The complaint provides an architectural diagram for the GeoSoft virtual monitor, illustrating its components including a virtualization layer, networking hardware, and a management and orchestration layer (Compl. p. 17, ¶58). A screenshot from the Iris Session Analyzer shows a user interface displaying a table of distinct network flows with details such as start/end times and application names (Compl. p. 18, ¶60).

IV. Analysis of Infringement Allegations

6,651,099 Infringement Allegations

Claim Element (from Independent Claim 1) Alleged Infringing Functionality Complaint Citation Patent Citation
a parser subsystem... configured to examine the packet... extract selected portions of the accepted packet, and form a function of the selected portions sufficient to identify... a conversational flow-sequence The accused products utilize a combination of IP addresses, port numbers, and protocol ("5-Tuple" information) to identify flows and create a key for lookup. ¶61, ¶62 col. 5:19-25
a memory storing a flow-entry database The accused products maintain a flow-entry database, a partial list of which is depicted in a screenshot of the Iris Session Analyzer showing a table of flow records. ¶61 col. 5:26-27
a lookup engine... configured to determine... if there is an entry in the flow-entry database The accused products use a lookup engine to compare the 5-Tuple information of a new packet against keys associated with entries in the flow-entry database to find a match. ¶62 col. 5:45-50
a state patterns/operations memory configured to store a set of predefined state transition patterns and state operations The accused products' Deep Packet Classification uses "signature plug-ins," which are described as a set of predefined state patterns and state operations. ¶64 col. 15:1-10
a state processor configured to carry out any state operations... furthering the process of identifying which application program is associated with the conversational flow-sequence The Deep Packet Classification (DPC) engine allegedly applies the next state machine transition based on the last recorded state of the conversational flow to identify the application. ¶66 col. 5:51-57
  • Identified Points of Contention:
    • Scope Questions: A primary question may be whether the accused products' "Deep Packet Classification" engine, which classifies traffic based on "signature plug-ins," performs the same function as the claimed "state processor." The dispute may center on whether the DPC engine's functionality extends beyond single-session classification to the tracking of multi-part "conversational flows" as described in the patent's specification.
    • Technical Questions: The complaint alleges the DPC engine "applies the next state machine transition... that follows from the last state recorded for the conversational flow" (Compl. ¶66). A key factual question will be what technical evidence supports this allegation. For example, does the system actually link a service setup transaction (e.g., an RPC port mapping) with a subsequent data transaction using that service, as contemplated by the patent?

6,665,725 Infringement Allegations

Claim Element (from Independent Claim 17) Alleged Infringing Functionality Complaint Citation Patent Citation
a memory configured to store a database of parsing/extraction operations compiled from one or more protocol descriptions The complaint alleges the accused products use "signature plug-ins" and that new application classification can be incorporated through the "routine availability" of these plug-ins, suggesting a programmable or updatable system. ¶63 col. 4:44-58
a parser subsystem... configured to... extract identifying information from the packet based on parsing/extraction operations retrieved from the memory The accused products perform Deep Packet Classification, which involves parsing packets and extracting "5-Tuple" information to identify the flow and application. A screenshot shows the system identifying "Google" as the "Flow Application." ¶61, ¶65 col. 4:59-64
an analyzer subsystem... configured to identify an application program associated with the packet The DPC engine, coupled with the "signature-plugins database," is alleged to "conclusively classify the application or protocol contained" in a packet. The complaint points to product literature and a screenshot from the Iris Session Analyzer as evidence. ¶65, ¶60 col. 5:2-6
  • Identified Points of Contention:
    • Scope Questions: The central issue for this patent will likely be the construction of "compiled from one or more protocol descriptions." The question for the court will be whether the accused system's method of using and updating "signature plug-ins" falls within the scope of this limitation, which the patent specification links to a "high-level protocol description language."
    • Technical Questions: What is the technical nature of a "signature plug-in"? The complaint alleges they are sets of predefined state patterns (Compl. ¶64). The case may turn on evidence showing how these plug-ins are created, formatted, and integrated into the accused system, and whether that process is equivalent to compiling a high-level description as claimed.

V. Key Claim Terms for Construction

  • Term: "state processor" (’099 Patent, Claim 1)

    • Context and Importance: The functionality of the "state processor" is a cornerstone of the ’099 patent's asserted advance over the prior art. Whether the accused DPC engine meets this limitation will be critical to the infringement analysis. Practitioners may focus on this term because it distinguishes a simple classifier from a monitor capable of understanding complex, multi-stage network conversations.
    • Intrinsic Evidence for Interpretation:
      • Evidence for a Broader Interpretation: The Abstract describes the method as performing "any state processing for an identified state to further the process of identifying the flow." (’099 Patent, Abstract). This language could be argued to encompass any system that uses information from one packet to inform the analysis of a subsequent packet in the same flow.
      • Evidence for a Narrower Interpretation: The background section emphasizes the problem of recognizing "disjointed flows as belonging to the same conversational flow," using protocols like RPC and SAP as examples where a service is established in one connection and used in another. (’099 Patent, col. 3:6-51). This context may support a narrower construction that requires the ability to link logically related but distinct network sessions.

  • Term: "protocol descriptions" (’725 Patent, Claim 17)

    • Context and Importance: Infringement of the ’725 patent hinges on whether the accused system's "signature 'plug-ins'" (Compl. ¶63) are derived from what the patent calls "protocol descriptions." The construction of this term will define the scope of the patent's protection for programmable monitors.
    • Intrinsic Evidence for Interpretation:
      • Evidence for a Broader Interpretation: The specification states that a "protocol description language (PDL) file... describes both patterns and states of all protocols that an occur at any layer." (’725 Patent, col. 12:25-28). This could support a broad interpretation covering any data file or structure that defines patterns for packet classification.
      • Evidence for a Narrower Interpretation: The patent repeatedly refers to a "high-level protocol description language" and a "compiler" that processes it. (’725 Patent, col. 4:44-58). This suggests a human-readable, source code-like definition language, which could be construed more narrowly than pre-compiled binary updates or proprietary signature files.

VI. Other Allegations

  • Indirect Infringement: The complaint alleges both induced and contributory infringement for all five patents-in-suit. Inducement is based on allegations that Defendants market the infringing capabilities of their products and provide instructions, technical support, and encouragement for their use (Compl. ¶71, 79, 87, 94, 102). Contributory infringement is based on allegations that the accused products are specially made or adapted to practice the patented inventions, constitute a material part of the invention, and have no substantial non-infringing use (Compl. ¶72, 80, 88, 95, 103).
  • Willful Infringement: Willfulness is alleged for all asserted patents. The complaint bases its claim of pre-suit knowledge on the prosecution histories of patents now owned by NetScout through its acquisitions of Arbor Networks, Tektronix, and Fluke Corporation. For each asserted patent, the complaint identifies a specific date on which the USPTO allegedly mailed a patent examiner's citation of the asserted patent during the prosecution of an application that later became a NetScout-owned patent (Compl. ¶70, 78, 86, 101).

VII. Analyst’s Conclusion: Key Questions for the Case

  • A core issue will be one of functional equivalence: Do the accused products' "Deep Packet Classification" and "signature plug-in" architecture perform the specific, multi-stage stateful analysis required by the '099 patent to link disjointed conversational flows, or do they perform a more limited form of session-level application identification that falls short of the claimed invention?
  • A key legal question will be one of definitional scope: Can the term "compiled from one or more protocol descriptions" from the '725 patent, which the specification ties to a high-level descriptive language, be construed broadly enough to read on the accused system's use of updatable "signature 'plug-ins'"?
  • An important factual question for damages will be corporate knowledge: Does the citation of the patents-in-suit during the prosecution of patents that were later acquired by Defendant establish pre-suit knowledge sufficient to support a finding of willful infringement, particularly given the chain of corporate acquisitions separating the original patent applicants from the current defendant?