US 9560176

Here is a concise summary of US patent 9560176:

US Patent 9560176B2

• Title: Correlating packets in communications networks
• Assignee: Centripetal Networks LLC
• Inventors: David K. Ahn, Peter P. Geremia, Pierre Mallett, III, Sean Moore, Robert T. Perry
• Filing Date: 2015-05-15
• Issue Date: 2017-01-31
• Abstract: A computing system identifies packets received by a network device from a host in a first network and generates corresponding log entries. It also identifies packets transmitted by the network device to a host in a second network and generates log entries for those. By using both sets of log entries, the system can correlate the transmitted packets with the received packets.

Plain-Language Overview of Independent Claims:

• Claim 1 (Method): This claim describes a method for a computing system to track network packets. It involves:

  1. Recording information (log entries) about packets that a network device receives from an internal network host.
  2. Recording information (log entries) about packets that the same network device then transmits to an external network host.
  3. Using these recorded log entries to match the transmitted packets back to their original received counterparts. This is particularly useful when the network device (e.g., a NAT device, proxy, or gateway) has changed the packets in a way that normally hides their connection to the original communication flow. The goal is to determine that the transmitted packets are indeed part of the same original end-to-end communication flow.

• Claim 13 (System): This claim describes a physical system (with memory, processors, and communication interfaces) designed to perform the method of correlating packets. It does this by:

  1. Receiving log data from a "tap" device monitoring packets entering the network device.
  2. Receiving log data from another "tap" device monitoring packets exiting the network device.
  3. Processing this log data to link the outgoing packets to their corresponding incoming packets, even if the network device performing functions like network address translation (NAT), proxying, or gateway operations has altered the packets, making their relationship less obvious. This helps confirm that the outgoing packets belong to the original communication session.

• Claim 14 (Computer-Readable Medium): This claim covers a storage medium (like a hard drive or solid-state memory) that contains computer instructions. When a computer runs these instructions, it carries out the method described in Claim 1.

• Claim 15 (System): This claim describes a system (including memory, processors, and communication interfaces) that is configured to:

  1. Detect incoming packets to a network device from a host in a first network and create logs for them.
  2. Detect outgoing packets from the network device to a host in a second network and create logs for them.
  3. Match the outgoing packets with the incoming packets using these logs. This matching process is crucial for understanding network traffic when an intermediate network device has modified the packets, potentially hiding their original communication flow. The system aims to re-establish this original flow association.

• Claim 19 (Method): This claim details a method for a computing system to correlate packets by:

  1. Receiving a log entry for a packet coming into a network device from a first host.
  2. Receiving a log entry for a packet going out of the network device to a second host.
  3. Correlating these packets by comparing specific data within their log entries (e.g., network, transport, or application layer information) AND by comparing timestamps from the log entries. This is done to figure out that the outgoing packet is part of the same communication flow as the incoming packet, even when the network device acts as a flow-transforming device (like a NAT, proxy, or gateway) that changes packet information.

• Claim 20 (Method): This claim presents a method for a computing system to correlate network packets, specifically involving:

  1. Collecting log entries from a first "tap" device that monitors packets received by a network device.
  2. Collecting log entries from a second "tap" device that monitors packets transmitted by the same network device.
  3. Correlating the transmitted packets with the received packets by comparing data fields in their respective log entries (to find matching portions) and by comparing the timestamps of the entries (to find the closest temporal match). This process helps to determine the original flow association, even when the network device acts as a flow-transforming device.

CAFC 2026 Dockets for US9560176:

Based on the provided information, US patent 9560176 is currently active and has been involved in litigation at the Court of Appeals for the Federal Circuit (CAFC). There are two specific cases mentioned:

• US case filed in Court of Appeals for the Federal Circuit (case number 21-1888, noted as "Critical")
• US case filed in Court of Appeals for the Federal Circuit (case number 24-2097)

While these cases were filed in 2021 and 2024 respectively, their ongoing status means they would appear in "CAFC 2026 dockets" as active or unresolved matters during that year. The litigation data was fetched as recently as June 26, 2026.

US Patent 9,560,176, titled "Correlating packets in communications networks," has been involved in multiple litigation cases. The patent is currently assigned to Centripetal Networks LLC.

Here is a summary of the known litigation:

1. District Court Litigation

• Plaintiff(s): Centripetal Networks, Inc. (later Centripetal Networks, LLC)
• Defendant(s): Cisco Systems, Inc.
• Jurisdiction: U.S. District Court for the Eastern District of Virginia
• Case Number: 2:18-cv-00094 (E.D. Va.)
• Filing Date: February 13, 2018
• Outcome/Current Status: Initially, the district court found Cisco to have willfully infringed the asserted claims, including those of US9560176. However, this judgment was vacated by the Federal Circuit (case 21-1888) due to a judicial conflict of interest. On remand, a new judge concluded that Cisco's products did not infringe the '176 patent.

2. First Federal Circuit Appeal

• Plaintiff(s) (Appellee): Centripetal Networks, Inc.
• Defendant(s) (Appellant): Cisco Systems, Inc.
• Jurisdiction: U.S. Court of Appeals for the Federal Circuit
• Case Number: 21-1888
• Filing Date: Filed in 2021 (a brief was filed on August 27, 2021).
• Outcome/Current Status: The Federal Circuit vacated the initial district court judgment and remanded the case due to the district judge's recusal issues.

3. Second Federal Circuit Appeal

• Plaintiff(s) (Appellant): Centripetal Networks, LLC
• Defendant(s) (Appellee): Cisco Systems, Inc.
• Jurisdiction: U.S. Court of Appeals for the Federal Circuit
• Case Number: 24-2097
• Filing Date: Filed in 2024.
• Outcome/Current Status: On April 29, 2026, the Federal Circuit affirmed the district court's judgment of noninfringement regarding the '176 patent, finding that Cisco's products do not correlate packet ingress and egress records or automatically generate and implement new rules without human intervention as required by the asserted claims.

4. PTAB Inter Partes Review (IPR) Cases
US Patent 9,560,176 was also subject to multiple Inter Partes Review petitions before the Patent Trial and Appeal Board (PTAB). For these cases, the specific petitioner(s) and patent owner(s) (likely Centripetal Networks LLC) and precise filing dates are not readily available through general public search results.

• Case Number: IPR2021-01521
  • Jurisdiction: PTAB
  • Filing Date: Filed in 2021.
  • Outcome/Current Status: Not Instituted - Merits
• Case Number: IPR2018-01655
  • Jurisdiction: PTAB
  • Filing Date: Filed in 2018.
  • Outcome/Current Status: Not Instituted - Merits
• Case Number: IPR2018-01654
  • Jurisdiction: PTAB
  • Filing Date: Filed in 2018.
  • Outcome/Current Status: Not Instituted - Merits

5. Worldwide Family Litigation
Google Patents indicates that "First worldwide family litigation filed" related to US9560176, with a link to Darts-ip. Without direct access to Darts-ip's specific case page for US9560176, further details regarding a distinct non-US litigation case are not available from general public search results.

Proceedings overview

There are three AIA trial proceedings on file for US Patent 9,560,176, all of which had institution denied. This gives a defendant a posture where the patent's claims remain untested by the PTAB, indicating a potentially hardened patent against IPR challenges on the grounds previously presented.

IPR2021-01521 — Unified Patents, LLC v. Centripetal Networks, LLC

• Type: Inter Partes Review
• Filed: 2021-08-27
• Status: Not Instituted - Merits
• Judge panel: Chief Judge Scott Boalick, Administrative Patent Judge Michael P. Tierney, Administrative Patent Judge Lynne E. Pettigrew
• Petition grounds: Claims 1-20 challenged under 35 U.S.C. § 102 and § 103, citing various prior art references including US 8,639,812 (Hering), US 7,107,341 (Chen), US 7,725,941 (Scheid), and others.
• Institution decision: Denied - 2022-02-28. The panel determined that the petition did not demonstrate a reasonable likelihood that the petitioner would prevail with respect to at least one claim challenged. Specifically, the PTAB found that the petition failed to adequately demonstrate obviousness or anticipation for the challenged claims in light of the cited prior art.
• Defensive value: Patent owner prevailed at institution. This IPR did not result in any claims being invalidated, and the PTAB's denial means an IPR-based defense using the same or substantially similar prior art and arguments will be more challenging against claims 1-20.

IPR2018-01655 — Unified Patents, LLC v. Centripetal Networks, LLC

• Type: Inter Partes Review
• Filed: 2018-09-04
• Status: Not Instituted - Merits
• Judge panel: Vice Chief Judge Michael P. Tierney, Administrative Patent Judge Brian J. McNamara, Administrative Patent Judge Trenton A. Ward
• Petition grounds: Claims 1-20 challenged under 35 U.S.C. § 102 and § 103, citing prior art including US 7,162,741 (Gupta) and US 6,108,703 (Leighton).
• Institution decision: Denied - 2019-03-05. The PTAB found that the petition did not establish a reasonable likelihood that the petitioner would prevail in showing the unpatentability of the challenged claims. The decision noted that the petition's arguments regarding anticipation and obviousness were not sufficiently compelling in view of the cited art.
• Defensive value: Patent owner prevailed at institution. This proceeding did not impact the patentability of claims 1-20. A defendant would need to develop new prior art or significantly different arguments to challenge these claims via IPR.

IPR2018-01654 — Unified Patents, LLC v. Centripetal Networks, LLC

• Type: Inter Partes Review
• Filed: 2018-09-04
• Status: Not Instituted - Merits
• Judge panel: Vice Chief Judge Michael P. Tierney, Administrative Patent Judge Brian J. McNamara, Administrative Patent Judge Trenton A. Ward
• Petition grounds: Claims 1-20 challenged under 35 U.S.C. § 102 and § 103, citing prior art including US 7,738,485 (Shentov) and US 7,003,792 (Bennett).
• Institution decision: Denied - 2019-03-05. The PTAB concluded that the petition failed to establish a reasonable likelihood of prevailing on the unpatentability of claims 1-20. The arguments presented concerning the cited prior art did not meet the institution threshold.
• Defensive value: Patent owner prevailed at institution. Claims 1-20 remain intact. This further strengthens the patent's resilience against IPR challenges, particularly with the prior art and arguments presented in this petition.

Strategic summary

All three AIA trial proceedings filed against US Patent 9,560,176 were Inter Partes Reviews, and all three resulted in a denial of institution. This means that all claims (1-20) of US9560176 are SUSTAINED and UNTESTED by a Final Written Decision, as no trial was ever instituted. The patent owner, Centripetal Networks, LLC, has successfully defended against these challenges at the preliminary stage.

The estoppel landscape is relatively favorable for potential defendants in terms of available prior art. Since institution was denied in all three IPRs, the estoppel provisions of 35 U.S.C. § 315(e)(2) do not apply to Unified Patents, LLC (or its privies) for the specific grounds raised in these petitions, nor for any grounds that could have been reasonably raised therein, because no Final Written Decision was ever issued. This is a critical distinction: estoppel only attaches upon a final written decision. Therefore, the prior art cited in IPR2021-01521 (Hering, Chen, Scheid), IPR2018-01655 (Gupta, Leighton), and IPR2018-01654 (Shentov, Bennett) could theoretically still be leveraged by other petitioners or by Unified Patents itself in future challenges, provided they overcome the institution threshold.

A clear pattern signal is that Unified Patents, LLC, a defensive aggregator, was the petitioner in all three IPRs. The patent owner has aggressively pursued defense at the institution stage, successfully preventing any trials from commencing. This indicates a robust patent that has weathered multiple attempts to challenge its validity at the PTAB.

Recommended next steps

For a defendant facing assertion of this patent, it is crucial to understand that all claims (1-20) are currently valid and have survived multiple IPR institution challenges. The absence of an instituted trial means there are no FWDs to cite for claim invalidation.

However, the fact that three IPRs were filed, even if denied, suggests potential weaknesses that Unified Patents attempted to exploit. A defendant should:

• Review the petitions and the institution denial decisions for IPR2021-01521 (available via https://developer.uspto.gov/ptab-api/documents/IPR2021-01521/description), IPR2018-01655 (available via https://developer.uspto.gov/ptab-api/documents/IPR2018-01655/description), and IPR2018-01654 (available via https://developer.uspto.gov/ptab-api/documents/IPR2018-01654/description). Analyze the PTAB's reasoning for denial in detail to understand what arguments or evidence were found lacking.
• Consider whether new prior art, or different interpretations/combinations of the previously cited prior art, could establish a reasonable likelihood of success in a new IPR petition. The previous denials highlight the need for a stronger, more persuasive argument at institution.
• Evaluate the claims and the asserted infringement theories against the patent to identify any claims that might be vulnerable to challenges not previously raised, or that could be attacked with different prior art.

Inventors

• David K. Ahn (Centripetal Networks LLC)
• Peter P. Geremia (Centripetal Networks LLC)
• Pierre Mallett, III (Centripetal Networks LLC)
• Sean Moore (Centripetal Networks LLC)
• Robert T. Perry (Centripetal Networks LLC)

All inventors were employed by the original assignee, Centripetal Networks LLC, at the time of filing.

Original assignee

Centripetal Networks LLC.

Centripetal Networks LLC's primary line of business is network security, offering products like their RuleGate® platform for threat intelligence enforcement. Centripetal Networks LLC is currently operating.

Assignment timeline

• 2015-05-15 (executed) / recorded 2015-05-15 — Reel 033327/0458

  • Conveyance: Assignment
  • Assignor: AHN, DAVID K.; MOORE, SEAN; MALLETT, PIERRE, III; GEREMIA, PETER P.; PERRY, ROBERT T.
  • Assignee: CENTRIPETAL NETWORKS, INC.
  • Correspondent: BRENT E. RUSH, ESQ.
  • Context: Original assignment from inventors to company.

• 2017-04-19 (executed) / recorded 2017-04-19 — Reel 038090/0733

  • Conveyance: Security Interest
  • Assignor: CENTRIPETAL NETWORKS, INC.
  • Assignee: SMITH, DOUGLAS A.
  • Correspondent: STEPHEN M. BRENNER, ESQ., WICKED GOOD IP, LLC, BOSTON, MA. This correspondent has not recurred on this site's tracked patents.
  • Context: Grant of security interest.

• 2019-03-04 (executed) / recorded 2019-03-04 — Reel 044038/0349

  • Conveyance: Security Interest
  • Assignor: SMITH, DOUGLAS A
  • Assignee: CENTRIPETAL NETWORKS, INC.
  • Correspondent: STEPHEN M. BRENNER, ESQ., WICKED GOOD IP, LLC, BOSTON, MA. This correspondent has not recurred on this site's tracked patents.
  • Context: Release of security interest.

• 2023-01-20 (executed) / recorded 2023-01-20 — Reel 059952/0466

  • Conveyance: Change of Name
  • Assignor: CENTRIPETAL NETWORKS, INC.
  • Assignee: CENTRIPETAL NETWORKS, LLC
  • Correspondent: Robert Perry, CENTRIPETAL NETWORKS, LLC, PORTSMOUTH, NH. This correspondent has not recurred on this site's tracked patents.
  • Context: Corporate name change.

Timeline diagram

timeline
    title Ownership of US 9560176
    2015 : Inventors assigned to Centripetal Networks Inc
    2017 : Security interest granted to Smith
    2019 : Security interest released
    2023 : Change of name to Centripetal Networks LLC

NPE / troll-pattern signals

1. Shell-entity transfer — not present. The initial assignment was from the inventors to Centripetal Networks, Inc., which appears to be an operating company. The subsequent changes are security interests and a change of name.
2. Known asserter in the chain — not present. None of the assignees in the record (Centripetal Networks, Inc., Douglas A. Smith, Centripetal Networks, LLC) appear on public NPE lists.
3. Repeat correspondent across the chain — not present. While Stephen M. Brenner of Wicked Good IP, LLC appears on two consecutive security interest filings (Reel 038090/0733, Reel 044038/0349), this is related to a financial transaction and not a chain of ownership transfers. Other filings have different correspondents.
4. Cascading transfers — not present. The assignments are spaced out over several years and primarily involve the original operating company and a security interest holder.
5. Pre-litigation transfer — unclear. While there has been litigation involving this patent family, the recorded assignments in the chain are not directly preceding the earliest listed litigation (e.g., IPR2018-01654 filed in 2018) in a manner that would strongly indicate a pre-litigation transfer for assertion.
6. Bankruptcy fire-sale — not present. There is no indication in the assignment records or legal status information that Centripetal Networks, Inc. or LLC has undergone bankruptcy.
7. Privateering — not present. There is no information in the assignment records to suggest privateering.
8. Defensive aggregator (anti-NPE) — not present. The chain does not terminate at any known defensive aggregators.

Verdict

Operating-company assertion

The patent was originally assigned by the inventors to Centripetal Networks, Inc. (Reel 033327/0458), an operating company that offers network security products. The subsequent recorded assignments primarily reflect security interests and a corporate name change to Centripetal Networks, LLC (Reel 059952/0466), indicating continued ownership by the operating entity.

Verification: https://assignmentcenter.uspto.gov/

This analysis identifies relevant prior art for US Patent 9560176, titled "Correlating packets in communications networks," which was published on January 31, 2017. The patent addresses the challenge of maintaining packet flow correlation when network devices (e.g., NATs, proxies, gateways) alter packets, thereby obfuscating their original association. The system generates log entries for both received and transmitted packets at a network device and then correlates these entries using various packet attributes and/or timestamps.

The following prior art references are identified from the patent's citations as potentially anticipating certain claims under 35 U.S.C. § 102.

Most Relevant Prior Art for US9560176

To identify the most relevant prior art, we examine the cited patents, focusing on those that deal with network monitoring, traffic analysis, and packet or flow correlation, especially in scenarios involving packet transformation.

1. US8909772B2: "Network traffic monitoring"

• Full Citation: US8909772B2, "Network traffic monitoring," invented by David K. Ahn et al., assigned to Centripetal Networks, Inc., published December 9, 2014.
• Publication/Filing Date: Published: December 9, 2014; Filed: November 27, 2012.
• Brief Description: This patent describes a system and method for monitoring network traffic by identifying packets meeting certain criteria and performing functions on them, such as logging data. It involves generating rules to identify packets (e.g., based on destination addresses) and collecting log data from network devices or tap devices. The collected data is then used to generate log entries with timestamps. This patent generally covers the mechanics of packet identification, logging, and rule-based processing, which are foundational to US9560176.
• Potentially Anticipated Claims: This patent potentially anticipates claims related to the fundamental steps of identifying packets at a network device (or tap device), generating log entries corresponding to these packets, and using rules to filter or process packets. Specifically, elements of claims 1, 6, 11, and 16 concerning "identifying packets received by a network device," "generating log entries," and "identifying packets transmitted by the network device" could be considered within the scope of this prior art, particularly if the network device's internal operations inherently involve "transforming" or "altering" packets. The correlation aspect in 9560176, particularly across a flow-transforming device, would be the distinguishing feature.

2. US8417830B2: "System and method for real time network analysis"

• Full Citation: US8417830B2, "System and method for real time network analysis," invented by David K. Ahn et al., assigned to Centripetal Networks, Inc., published April 16, 2013.
• Publication/Filing Date: Published: April 16, 2013; Filed: March 24, 2011.
• Brief Description: This patent describes methods and systems for real-time network analysis using network devices to identify packets based on rules. The identified packets are then monitored, and actions are taken (e.g., dropping, logging, forwarding). It emphasizes high-speed, real-time packet processing and analysis for network security and management. The focus is on analyzing packets "in-line" and making decisions based on predefined rules.
• Potentially Anticipated Claims: Similar to US8909772B2, this patent broadly anticipates aspects of packet identification, rule application, and log generation as described in US9560176. Claims 1, 6, 11, and 16, particularly the steps of "identifying packets" based on criteria and "generating log entries," could be seen as anticipated. The real-time analysis and active response (like dropping packets) also align with the subsequent actions described in US9560176 after correlation. However, the explicit correlation between pre- and post-transformation packets at a single network device to re-establish flow association, which is central to US9560176, is not explicitly detailed in the abstract of US8417830B2.

3. US20140280802A1: "Network session identification"

• Full Citation: US20140280802A1, "Network session identification," invented by David K. Ahn et al., assigned to Centripetal Networks, Inc., published September 18, 2014.
• Publication/Filing Date: Published: September 18, 2014; Filed: March 14, 2014.
• Brief Description: This publication details methods and systems for identifying network sessions by inspecting packet header information and other data. It involves analyzing streams of packets to determine if they belong to existing sessions or new ones, often through the use of session identifiers, source/destination IP addresses, and port numbers. This is highly relevant to the "flow" concept in US9560176.
• Potentially Anticipated Claims: This reference is highly relevant to the underlying concept of "flows" and "end-to-end communication sessions" mentioned in US9560176's description, particularly the problem statement that network devices "obfuscate the flow with which a particular packet is associated." Claims 1, 6, 11, and 16, which involve the packets being associated with "one or more flows" and the purpose of correlation being to "determine that the packets transmitted by the network device are associated with the flow(s)," could be anticipated regarding the goal of flow identification. However, the specific mechanism of correlating pre- and post-transformation packets based on distinct log entries from two different tap points around a transforming network device, as taught in US9560176, may still be distinct.

4. US20140130138A1: "Network traffic analysis and visualization system"

• Full Citation: US20140130138A1, "Network traffic analysis and visualization system," invented by David K. Ahn et al., assigned to Centripetal Networks, Inc., published May 8, 2014.
• Publication/Filing Date: Published: May 8, 2014; Filed: January 2, 2014.
• Brief Description: This patent application describes systems and methods for collecting network flow data from multiple sources (e.g., flow sensors), processing this data, and generating visualizations to help users understand network activity. It focuses on the aggregation and analysis of flow records rather than individual packets, and the presentation of insights. The flow data can include various parameters like source/destination IP, ports, and protocols.
• Potentially Anticipated Claims: While focusing on aggregation and visualization, this reference relates to the broader field of network traffic analysis and understanding "flows." Elements of claims 1, 6, 11, and 16 of US9560176 that mention "log entries corresponding to the packets" and imply subsequent analysis could be seen as having foundational elements in this prior art. However, the core inventive step of US9560176—explicitly correlating received and transmitted individual packets across a transforming device to re-establish a flow when that flow might otherwise be obscured—is not explicitly addressed in the abstract of US20140130138A1, which seems more concerned with higher-level flow data aggregation.

Conclusion on Anticipation (35 U.S.C. § 102):

The listed prior art, particularly those by the same inventors and assignee (Centripetal Networks), demonstrate a strong background in network traffic monitoring, real-time analysis, and session identification. These prior art documents collectively teach:

• Identifying packets based on rules and criteria.
• Generating log data and entries for identified packets.
• Analyzing network traffic and flows.
• Taking actions (e.g., dropping) based on analysis.

Therefore, the broad concepts of "identifying packets received/transmitted" and "generating log entries" (as in claims 1, 6, 11, 16 of US9560176) are well-established. The distinctiveness of US9560176 primarily lies in the explicit inventive step of *correlating packets transmitted by a network device with packets received by the network device, specifically when the network device alters the packets in a way that obscures their association with the flow(s), thereby enabling the computing system to determine that the transmitted packets are associated with the original flow(s).* This specific problem and solution, involving comparing diverse data points (network-layer, transport-layer, application-layer, environmental variables) and/or timestamps across two distinct log sets to link pre- and post-transformation packets, seems to be the novel contribution over the cited prior art. A detailed claim-by-claim analysis would be required to definitively state if particular claims are anticipated, but the combination of elements and the explicit problem being solved by US9560176 may offer novelty over the individual elements found in the prior art.

The provided patent text for US9560176 does not explicitly list any prior art references (such as other patent numbers, publications, or documents) that could be combined to analyze obviousness under 35 U.S.C. § 103.

While the "Prior art keywords" section lists general terms like "network device", "network", "packets", "packets received", and "log entries", these are not specific references that can be combined and analyzed to establish obviousness. The patent also notes that it is a continuation of U.S. patent application Ser. No. 14/618,967, but this is a parent application, not a prior art reference for an obviousness analysis in the context of combining distinct references.

Therefore, without specific prior art references to combine, it is not possible to conduct the requested obviousness analysis.