Centripetal Networks, LLC v. Cisco Systems, Inc.

N OTE: This disposition is nonprecedential.
United States Court of Appeals
for the Federal Circuit
______________________
CENTRIPETAL NETWORKS, LLC,
Plaintiff-Appellant
v.
CISCO SYSTEMS, INC.,
Defendant-Appellee
______________________
2024-2097
______________________
Appeal from the United States District Court for the
Eastern District of Virginia in No. 2:18-cv-00094-EWH-
LRL, Judge Elizabeth W. Hanes.
______________________
Decided: April 29, 2026
______________________
MATTHEW ROWEN, Clement & Murphy, PLLC, Alex-
andria, VA, argued for plaintiff-appellant. Also repre-
sented by P AUL D. CLEMENT , J OSEPH D EMOTT .
MARK CHRISTOPHER F LEMING, Wilmer Cutler Picker-
ing Hale and Dorr LLP, Boston, MA, argued for defend-
ant-appellee. Also represented by WILLIAM F. L EE ; HEATH
BROOKS , N ORA N. XU, Washington, DC; MATTHEW
CHRISTOPHER G AUDET , L. N ORWOOD J AMESON, Duane
Morris LLP, Atlanta, GA.
Case: 24-2097 Document: 62 Page: 1 Filed: 04/29/2026

-- 1 of 19 --

CENTRIPETAL NETWORKS, LLC v. CISCO SYSTEMS, INC. 2
______________________
Before L OURIE, D YK, and T ARANTO, Circuit Judges.
D YK, Circuit Judge.
Centripetal Networks, LLC (“Centripetal”) appeals
the district court’s judgment of noninfringement in favor
of Cisco Systems, Inc. (“Cisco”) as to the asserted claims of
three of its patents—U.S. Patent Nos. 9,686,193 (“’193
patent”), 9,203,806 (“’806 patent”), and 9,560,176 (“’176
patent”). These patents relate to filtering packets of data
for security threats when they are transferred between
computer networks.
The district court held that Cisco’s products do not in-
fringe the ’193 patent because they filter packets by
source and destination, which only meets step one of two
filtration steps that the asserted claims require. The
district court also held that Cisco’s products do not in-
fringe the ’806 patent because the claim term “responsive
to” requires but-for causation of “ceas[ing] processing”
packets in “respons[e] to” a signal, and Cisco’s products do
not perform this step. Finally, the district court held that
Cisco’s products do not infringe the ’176 patent because
they do not correlate packet ingress and egress records or
automatically generate and implement new rules without
human intervention as required by the asserted claims.
We affirm all three rulings and accordingly affirm the
district court’s judgment of noninfringement.
BACKGROUND
This case comes to us for a second time. Following a
bench trial, the district court originally entered judgment
holding that Cisco willfully infringed the asserted claims
of the ’193, ’806, and ’176 patents. Centripetal Networks,
Inc. v. Cisco Sys., Inc., 38 F.4th 1025, 1027 (Fed. Cir.
2022). While the case was pending, the district judge
discovered his wife owned Cisco stock. Id. at 1028. Cisco
Case: 24-2097 Document: 62 Page: 2 Filed: 04/29/2026

-- 2 of 19 --

CENTRIPETAL NETWORKS, LLC v. CISCO SYSTEMS, INC. 3
moved for the judge’s recusal under 28 U.S.C. § 455. Id.
at 1029. In an attempt to comply with the statutory
requirements, the judge placed his wife’s stock in a blind
trust and denied Cisco’s motion. Id. On appeal, we held
that placing stock in a blind trust did not satisfy the
requirements of § 455(f) and accordingly vacated the
district court’s judgment; ordered that the case “be as-
signed to a new judge . . . pursuant to Rule 63;” and
remanded “for further proceedings before [the] newly
appointed judge, who shall decide the case without regard
for the vacated opinions and orders.” Id. at 1040. On
remand, the new judge concluded Cisco did not infringe
the three asserted patents.
Although the district court did not resolve questions
of infringement with respect to another asserted patent,
U.S. Patent No. 9,917,856, the district court issued a
Rule 54(b) judgment as to the three patents found not to
infringe. Centripetal appeals.
I. T HE ASSERTED P ATENTS AND CISCO’S ACCUSED
P RODUCTS
The case involves three separate patents. The
’193 patent relates to filtering network data transfers to
prevent “[a] category of cyber attack known as exfiltra-
tions,” ’193 patent, col. 1 ll. 24–27, which “involve[] a
circumstance where an attacker gains access to a comput-
er inside of a network and sends protected information
outside of that network,” J.A. 34 n.5.1 Claim 18, which is
representative of the asserted claims, recites, in relevant
part:
A system comprising:
at least one processor; and
1 Citations to the J.A. refer to the Confidential
Joint Appendix filed by the parties at Dkt. No. 23.
Case: 24-2097 Document: 62 Page: 3 Filed: 04/29/2026

-- 3 of 19 --

CENTRIPETAL NETWORKS, LLC v. CISCO SYSTEMS, INC. 4
a memory storing instructions that when
executed by the at least one processor
cause the system to:
receive, from a computing device
located in a first network, a plural-
ity of packets wherein the plurali-
ty of packets comprises a first
portion of packets and a second
portion of packets;
responsive to a determination that
the first portion of packets com-
prises data corresponding to crite-
ria specified by one or more
packet-filtering rules configured to
prevent a particular type of data
transfer from the first network to
a second network, wherein the da-
ta indicates that the first portion
of packets is destined for the sec-
ond network:
apply, to each packet in the
first portion of packets, a first
operator, specified by the one
or more packet-filtering rules,
configured to drop packets as-
sociated with the particular
type of data transfer; and
drop each packet in the first
portion of packets. . . .
’193 patent, claim 18 (emphases added).
The specification of the ’193 patent explains that
“[t]he filtering process described herein may be viewed as
having two (2) stages” where “the first stage may deter-
Case: 24-2097 Document: 62 Page: 4 Filed: 04/29/2026

-- 4 of 19 --

CENTRIPETAL NETWORKS, LLC v. CISCO SYSTEMS, INC. 5
mine if the network policy allows any communications
between the resources identified in the 5-tuple rule,”2 for
example, between the source and destination networks of
a packet, and “the second stage may determine if the
policy allows the specific method or type of communica-
tion . . . between the resources.” Id. col. 8 ll. 39–52.
Similarly, in opposing a petition for Inter Partes Review
(“IPR”) before the United States Patent and Trademark
Office (“PTO”), Centripetal cited this language from the
specification and confirmed that “[t]hese rules involve
implementing a two-stage process for filtering traffic[.]”
J.A. 19013 (quoting ’193 patent, col. 8 ll. 45–52).
The ’806 patent relates to swapping rules that net-
work protection devices use to filter data packets.
’806 patent, abstract. “Such rules are often grouped into
rule sets, which may form one or more network policies.”
Id. col. 1 ll. 11–13. Claim 9, which is representative of the
asserted claims, recites, in relevant part:
A system comprising:
a plurality of processors; and
a memory comprising instructions that
when executed by at least one processor of
the plurality of processors cause the sys-
tem to: . . .
configure at least two processors of
the plurality of processors to pro-
cess packets in accordance with
the first rule set . . .
2 The 5-tuple refers to certain source, destination,
and network flow information in a data packet header:
“the source IP, the source port, the destination IP, the
destination port, and the protocol.” J.A. 1991; see also
’193 patent, col. 8 ll. 39–42.
Case: 24-2097 Document: 62 Page: 5 Filed: 04/29/2026

-- 5 of 19 --

CENTRIPETAL NETWORKS, LLC v. CISCO SYSTEMS, INC. 6
configure, each processor of the at least
two processors to, responsive to being sig-
naled to process packets in accordance
with the second rule set:
cease processing of one or more
packets;
cache the one or more packets;
reconfigure to process packets in
accordance with the second rule
set;
signal completion of reconfigura-
tion to process packets in accord-
ance with the second rule set; and
responsive to receiving signaling
that each other processor of the at
least two processors has completed
recon figuration to process packets
in accordance with the second rule
set, process, in accordance with
the second rule set, the one or
more packets.
’806 patent, claim 9 (emphases added).
The ’176 patent relates to a system that correlates
packets transmitted and received by a network device.
’176 patent, abstract. Claim 11, which is representative
of the asserted claims, recites:
A system comprising:
at least one processor; and
a memory storing instructions that when
executed by the at least one processor
cause the system to:
Case: 24-2097 Document: 62 Page: 6 Filed: 04/29/2026

-- 6 of 19 --

CENTRIPETAL NETWORKS, LLC v. CISCO SYSTEMS, INC. 7
identify a plurality of packets re-
ceived by a network device from a
host located in a first network;
generate a plurality of log entries
corresponding to the plurality of
packets received by the network
device;
identify a plurality of packets
transmitted by the network device
to a host located in a second net-
work;
generate a plurality of log entries
corresponding to the plurality of
packets transmitted by the net-
work device;
correlate, based on the plurality of
log entries corresponding to the
plurality of packets received by
the network device and the plural-
ity of log entries corresponding to
the plurality of packets transmit-
ted by the network device, the plu-
rality of packets transmitted by
the network device with the plu-
rality of packets received by the
network device; and
responsive to correlating the plu-
rality of packets transmitted by
the network device with the plu-
rality of packets received by the
network device:
generate, based on the corre-
lating, one or more rules con-
figured to identify packets
Case: 24-2097 Document: 62 Page: 7 Filed: 04/29/2026

-- 7 of 19 --

CENTRIPETAL NETWORKS, LLC v. CISCO SYSTEMS, INC. 8
received from the host located
in the first network; and
provision a device located in
the first network with the one
or more rules configured to
identify packets received from
the host located in the first
network.
’176 patent, claim 11 (emphases added).
Cisco markets and sells networking technology, in-
cluding network security products. Centripetal alleges
that several combinations of Cisco’s networking hardware
and software infringe the asserted claims. Most critical to
this appeal are Cisco’s switches and routers that are used
to connect computing devices. Switches connect multiple
devices on a single network, and routers connect devices
across multiple networks.
II. P ROCEDURAL H ISTORY
In 2018, Centripetal sued Cisco for infringement of
the ’193, ’806, and ’176 patents.3 Between May 6 and
June 11, 2020, the court held a twenty-two-day bench
trial over video-conference. On October 5, 2020, the
district court entered judgment in favor of Centripetal,
finding that Cisco willfully infringed the asserted claims
of the ’193, ’806, and ’176 patents.
After trial, Cisco moved for the district court judge’s
recusal based on his wife’s stock ownership in Cisco. The
district judge placed the stock in a blind trust and denied
3 Various other patents were involved at other
stages of the case. For example, the asserted claims of
U.S. Patent No. 9,137,205 were found not infringed. As
noted, issues of infringement as to the ’856 patent remain
pending.
Case: 24-2097 Document: 62 Page: 8 Filed: 04/29/2026

-- 8 of 19 --

CENTRIPETAL NETWORKS, LLC v. CISCO SYSTEMS, INC. 9
the recusal motion, and Cisco appealed. On appeal, we
concluded that the district court judge was required to
recuse, vacated the judgment, and remanded the case for
further proceedings with a new judge pursuant to Federal
Rule of Civil Procedure 63 without regard to the vacated
opinion. Centripetal, 38 F.4th at 1039–40.
On August 23, 2022, the case was reassigned to a new
judge. Pursuant to Rule 63, the parties were given an
opportunity to recall any witness whose testimony was
material and disputed, but chose not to do so. Centripetal
and Cisco also each filed a trial brief, presenting their
claims and defenses, and filed proposed findings of fact
and conclusions of law. The new judge then certified her
familiarity with the record and held a hearing where each
side presented a technology tutorial and presented argu-
ment on the ’193, ’806, and ’176 patents.
On December 11, 2023, the district court issued an
opinion granting judgment of noninfringement with
respect to the three patents.4 As to the ’193 patent, the
district court first found that the asserted claims describe
“a two-stage filtering method” where “[t]he first stage may
determine if the network policy allows any communica-
tions between the resources identified in the 5-tuple rule”
and “the second stage may determine if the policy allows
the specific method or type of communication.” J.A. 41
(quoting ’193 patent, col. 8 ll. 45–52). The court then
concluded that the second stage requires “filtration of a
subset of packets sent between computers in two different
networks,” i.e., that the system “drop some, but not all,
packets sent between two different network destinations”
which was a “functionality . . . not present in the accused
technology.” J.A. 46.
4 The asserted claims of the ’856 patent were stayed
and the district court issued a Rule 54(b) judgment.
Case: 24-2097 Document: 62 Page: 9 Filed: 04/29/2026

-- 9 of 19 --

CENTRIPETAL NETWORKS, LLC v. CISCO SYSTEMS, INC. 10
As to the ’806 patent, the district court concluded that
Cisco’s products do not infringe the asserted claims be-
cause the “cease/cache functionality . . . occurred as a part
of normal packet processing in Cisco’s accused devices,
not in response to a signal to swap to a new rule set.”
J.A. 60–61.
As to the ’176 patent, the district court concluded that
Centripetal “failed to show that (1) the accused technology
correlates the packets entering and exiting a network
device and that (2) responsive to the correlating, the
system generates rules configured to identify patents in a
specific network.” J.A. 75–76.
On January 8, 2024, Centripetal filed a motion for
post-judgment relief. In relevant part, Centripetal argued
that the district court misconstrued the asserted claims of
the ’193 patent to require filtration of a subset of packets
between two computers when the claims only require
“filtration of a subset of data transfers from one network
made up of many computers to a second network.”
J.A. 22129 (emphases in original). Under its proposed
construction, Centripetal argued that Cisco’s switches and
routers infringe the asserted claims because they “block a
particular subset of data transfers [from computers with a
quarantine tag] from the first network to the second
network.” J.A. 22132.
On June 14, 2024, the district court denied Centripe-
tal’s motion. The district court acknowledged that “it is
possible that the portion of first network packets de-
scribed in the claim language contains packets that
originated from multiple endpoint computers in the first
network” and thus that “blocking the SGT-tagged packets
received by the first network computing device may not
mean blocking all packets from that device.” J.A. 93.
However, the district court rejected Centripetal’s argu-
ment that Cisco’s quarantine procedure, which filters
packets based on their source and destination, filtered by
Case: 24-2097 Document: 62 Page: 10 Filed: 04/29/2026

-- 10 of 19 --

CENTRIPETAL NETWORKS, LLC v. CISCO SYSTEMS, INC. 11
a “particular type of data transfer” as required by the
claim language. Id. Instead, the district court clarified
that the plain and ordinary meaning of “‘particular type of
data transfer’ refers to the specific technique, or method,
associated with the transmission,” J.A. 94, and concluded
that Cisco’s products do not infringe the asserted claims
because they only filter packets by source and destination
(stage 1 filtering), not the specific technique or method of
the transfer, as required by stage 2.
Centripetal timely appeals. Because the district court
entered partial final judgment under Rule 54(b), we have
jurisdiction under 28 U.S.C. § 1295(a)(1).
D ISCUSSION
In the context of a bench trial, we review a district
court’s conclusions of law de novo and its factual findings
for clear error. Galderma Lab’ys, L.P. v. Lupin Inc.,
122 F.4th 902, 907 (Fed. Cir. 2024). Infringement is a
question of fact we review for clear error. Id. Claim
construction based on intrinsic evidence is an issue of law
that we review de novo. Teva Pharms. USA, Inc.
v. Sandoz, Inc., 574 U.S. 318, 326 (2015). To the extent
the claim construction depends on extrinsic evidence, we
review the district court’s factual findings under a clearly
erroneous standard. Id. at 331.
I
With respect to the ’193 patent, Centripetal argues
that the district court erred by improperly construing the
term “particular type of data transfer” to exclude source
and destination filtering pursuant to Cisco’s quarantine
procedure. Cisco argues that the district court’s construc-
tion is supported by the specification and the prosecution
history. We agree with Cisco.
Some background on Cisco’s accused products is use-
ful. Cisco’s switches and routers are configured to apply
packet-filtering rules, called access control lists (“ACLs”),
Case: 24-2097 Document: 62 Page: 11 Filed: 04/29/2026

-- 11 of 19 --

CENTRIPETAL NETWORKS, LLC v. CISCO SYSTEMS, INC. 12
that drop or forward packets. Centripetal alleges that a
particular ACL, called the Security Group ACL
(“SGACL”) or “quarantine rule,” which involves SGT-
tagging, infringes the ’193 patent. This rule operates by
directing a switch or router to drop a packet from a device
tagged with a quarantine tag, if it is headed to a restrict-
ed destination.
While the claim language itself is less than clear, both
the specification and the prosecution history make clear
that the claims require two-stage filtering; that the first
stage involves determining if the rules permit communi-
cation between two resources using the 5-tuple rule,
including source and destination filtering; and that the
second stage involves filtering by method or type of com-
munication, and does not include source and destination
filtering.5
The specification is “the single best guide to the mean-
ing of a disputed term.” Phillips v. AWH Corp., 415 F.3d
1303, 1315 (Fed. Cir. 2005) (en banc) (quoting Vitronics
Corp. v. Conceptronic, Inc., 90 F.3d 1576, 1582 (Fed. Cir.
1996)). As described above, the specification of the
’193 patent explains, “[t]he filtering process described
herein may be viewed as having two (2) stages.”
’193 patent, col. 8 ll. 39–40. It goes on to clarify that
“[c]onceptually, the first stage may determine if the
network policy allows any communications between the
resources [(network devices)] identified in the 5-tuple
rule” and “the second stage may determine if the policy
allows the specific method or type of communication . . .
between the resources.” Id. col. 8 ll. 45–52.
5 While the district court relied on a technical dic-
tionary to construe the asserted claims of the ’193 patent,
resorting to dictionaries is unnecessary here given the
clarity of the specification and prosecution history.
Case: 24-2097 Document: 62 Page: 12 Filed: 04/29/2026

-- 12 of 19 --

CENTRIPETAL NETWORKS, LLC v. CISCO SYSTEMS, INC. 13
Significantly, in its response to a petition for IPR,
Centripetal told the PTO that
the independent claims of the ’193 patent recite
rules for preventing the transfer of a subset of
packets out of the network. These rules involve
implementing a two-stage process for filtering
traffic:
Conceptually, the first stage may deter-
mine if the network policy allows any
communications between the resources
identified in the 5-tuple rule; if so, the
second stage may determine if the policy
allows the specific method or type of com-
munication (e.g., file read, file write, en-
crypted communication, etc.) between the
resources.
J.A. 19013 (emphasis in original) (quoting ’193 patent, col.
8 ll. 45–52).
Centripetal continued, “[t]hus the ’193 patent disclos-
es exemplary embodiments for preventing exfiltrations
when packets match (1) a particular source and destina-
tion criteria (e.g. the addresses of the first and second
network of each independent claim) . . . and (2) a particu-
lar type of data transfer[.]” J.A. 19014 (emphasis in
original). Accordingly, “once it is determined that a
received packet matches the source/destination crite-
ria . . ., the second stage . . . occurs, wherein an operator is
applied to drop packets associated with a ‘particular type
of data transfer.’” Id. In distinguishing the prior art
(Sourcefire), Centripetal argued that “Petitioner does not
allege that Sourcefire discloses this claimed two-stage
process.” J.A. 19024. These statements to the PTO make
clear that the asserted claims of the ’193 patent disclose a
two-stage filtering process and that the first stage in-
volves filtering based on source and destination using the
5-tuple rule.
Case: 24-2097 Document: 62 Page: 13 Filed: 04/29/2026

-- 13 of 19 --

CENTRIPETAL NETWORKS, LLC v. CISCO SYSTEMS, INC. 14
We recognized in Aylus Networks, Inc. v. Apple Inc.,
856 F.3d 1353 (Fed. Cir. 2017) that in “[a] patent owner's
preliminary response filed prior to an institution deci-
sion . . . . the patent owner can define claim terms and
otherwise make representations about claim scope to
avoid prior art,” which the public is entitled to rely on. Id.
at 1362 (citing Biogen Idec, Inc. v. GlaxoSmithKline LLC,
713 F.3d 1090, 1095 (Fed. Cir. 2013)). We accordingly
held that “statements made by a patent owner during an
IPR proceeding, whether before or after an institution
decision, can be considered for claim construction.” Id.;
see also Shire Dev., LLC v. Watson Pharms., Inc., 787 F.3d
1359, 1366 (Fed. Cir. 2015). Here, Centripetal’s state-
ments in the IPR proceeding define the scope of the as-
serted claims to require two-stage filtering, with source
and destination filtering being part of the first stage.
It is undisputed that the accused products here, Cis-
co’s switches and routers implementing the quarantine
rule, filter by source and destination at the first stage.
See Oral Arg. at 5:00–5:25 (Centripetal agreeing that
Cisco’s quarantine rule is applied “based on the criteria in
the 5-tuple”). Centripetal nonetheless argues that source
and destination filtering also satisfies filtering at the
second stage by “particular type of data transfer.” But on
the face of the specification and prosecution history, the
two stages are distinct and there is no indication that
source and destination filtering would satisfy the second
stage.6 Because Cisco’s accused products only filter by
source and destination, Cisco’s products do not infringe
the asserted claims of the ’193 patent. See Oral Arg.
6 The unasserted claims of the ’193 patent add limi-
tations specifying certain types of data transfers. See,
e.g., ’193 patent, claims 10–13, 15. Centripetal concedes
in its Reply Brief that these are examples of “particular
type[s] of data transfer[s].” Reply Br. 12.
Case: 24-2097 Document: 62 Page: 14 Filed: 04/29/2026

-- 14 of 19 --

CENTRIPETAL NETWORKS, LLC v. CISCO SYSTEMS, INC. 15
at 7:00–7:15 (Centripetal agreeing it would lose based on
this construction).
Centripetal also argues (somewhat inconsistently
with the concession described above) that we should
remand because the district court adopted a new claim
construction in its post-judgment opinion, and Centripetal
did not have the opportunity to present evidence of in-
fringement under this construction. But Centripetal had
adequate notice of Cisco’s claim construction positions
with respect to the ’193 patent. In its post-trial proposed
findings of fact and conclusions of law, Cisco argued that
the asserted claims of the ’193 patent require two-stage
filtering and that its products, which allow or drop pack-
ets by source and destination, are only capable of filtering
at the first stage. J.A. 17865–66. Cisco made the same
argument in its trial brief and at the Rule 63 hearing. See
J.A. 19450–54; 21283. Our cases make clear that, even in
the PTAB context (with more stringent procedural re-
quirements than in district court cases), any shift in the
original construction does not create any unfairness
where, as here, the challenger consistently put the pa-
tentee on notice of its interpretation of the asserted
claims. See Hamilton Beach Brands, Inc. v. f'real Foods,
LLC, 908 F.3d 1328, 1338–39 (Fed. Cir. 2018); Google
LLC v. EcoFactor, Inc., 92 F.4th 1049, 1057 (Fed. Cir.
2024).
Finally, Centripetal argues that Cisco’s products in-
fringe the asserted claims of the ’193 patent even under
the district court’s construction. Centripetal’s argument
appears to be based on the theory that Cisco’s switches
and routers could be modified to filter by a “particular
type of data transfer,” but this hardly suggests that
Cisco’s switches and routers infringe in their current
configurations. The testimony Centripetal cites to sup-
port the contention that Cisco’s switches and routers
already have this functionality only shows that the
switches and routers can identify and flag suspicious
Case: 24-2097 Document: 62 Page: 15 Filed: 04/29/2026

-- 15 of 19 --

CENTRIPETAL NETWORKS, LLC v. CISCO SYSTEMS, INC. 16
types of data transfers which “would lead to the [imple-
mentation of] quarantine rules.” J.A. 1512. Centripetal
has not identified any evidence suggesting that the quar-
antine rule filters by “particular type of data transfer.”
II
As to the ’806 patent, the issue is whether the district
court erred when it found Cisco’s accused devices to be
noninfringing because the claim-specified signal does not
cause those devices to “cease processing” packets.
’806 patent, claim 9. The accused products here are
Cisco’s switches, routers, and firewalls (in combination
with certain management programs) which can imple-
ment rule swapping procedures to update packet-filtering
rules. Once a rule swap procedure is activated, Cisco’s
products swap rules “during the devices’ existing idle
period between the processing of individual packets.”
J.A. 56; see also J.A. 58.
The district court found that the accused products do
not infringe the asserted claims because they “cease
[processing] . . . as a part of normal packet pro-
cessing[,] . . . not in response to a signal to swap to a new
rule set.” J.A. 60–61. Centripetal argues that the district
court must be reversed because “responsive to” only
requires that “when the system receives a signal to per-
form a rule swap, it immediately proceeds to perform the
entire rule-swapping sequence,” Appellant’s Br. 27, not
that the signal be the but-for cause of each component
part, such as “ceas[ing] processing.” Nothing in the
district court’s opinion, J.A. 52–57, or anything Centripe-
tal cites to us from its filings in the district court, indi-
cates that Centripetal fairly presented the district court
with this claim construction or argued that the plain and
ordinary meaning leads to this interpretation of the claim
(requiring causation of the sequence as a unit, but not of
any individual component). See Appellee’s Br. at 50
(asserting forfeiture of Centripetal’s causation position at
Case: 24-2097 Document: 62 Page: 16 Filed: 04/29/2026

-- 16 of 19 --

CENTRIPETAL NETWORKS, LLC v. CISCO SYSTEMS, INC. 17
Appellant’s Br. at 27, 44); Appellant’s Reply at 21–22 (not
identifying where in the district court the position was
presented). Under these circumstances, Centripetal
forfeited this argument.
In any event, the most natural understanding of the
claims is that the signal must be the but-for cause of
ceasing processing packets. The asserted claims specify a
list of actions the claimed processors must be configured
to do “responsive to being signaled to process packets in
accordance with the second rule set.” ’806 patent, claim 9.
The first item on this list is “cease processing of one or
more packets.” Id. The specification adds support to this
interpretation as it describes this causal relationship set
apart from any other elements of the rule swapping
procedure: “Responsive to signaling the processors to
process packets in accordance with the second rule set,
the processors may cease processing packets.” Id., col. 1
ll. 61–64.
As it is undisputed that Cisco’s accused products
cease processing packets in the normal course of pro-
cessing, and not in response to a signal, we conclude that
the accused products do not infringe the asserted claims
of the ’806 patent.
III
As to the ’176 patent, Centripetal alleges Cisco’s
switches and routers, using a threat analysis program
called Stealthwatch, infringe the asserted claims.
Stealthwatch analyzes logs of packet information (called
NetFlow logs) and sends alerts to a management console
based on suspected malicious activity. The district court
concluded that the accused products do not infringe the
asserted claims because Centripetal failed to show that
Cisco’s technology “correlates the packets entering and
exiting a network device” and “responsive to the correlat-
ing, . . . generates rules configured to identify packets in a
specific network.” J.A. 76. Centripetal argues the district
Case: 24-2097 Document: 62 Page: 17 Filed: 04/29/2026

-- 17 of 19 --

CENTRIPETAL NETWORKS, LLC v. CISCO SYSTEMS, INC. 18
court’s finding of noninfringement rests on erroneous
factual findings. Again, we disagree.
The district court determined that Cisco’s products do
not infringe the ’176 patent because they cannot correlate
NetFlow records. Centripetal argues that the district
court ignored evidence that the accused devices correlate
logging records other than NetFlow records, namely
Syslog and Webflow. But Centripetal conceded at the
Rule 63 hearing that its infringement position was based
on NetFlow records. J.A. 21464. (“I think the evidence
shows that NetFlow data is what we’re accusing of in-
fringing.”). And the district court cited ample evidence to
support the conclusion that Cisco’s products do not corre-
late ingress and egress NetFlow log entries. See J.A. 78–
81. Even if we were to consider Centripetal’s arguments
based on Syslog and Webflow, these logging records are
generated by proxy sources, not Cisco’s switches and
routers, see J.A. 75, 19969, 19979, and Centripetal’s
expert admitted that “we don’t actually have a proxy in
this case,” J.A. 1978.7
The district court also did not err in concluding that
Cisco’s accused products do not satisfy the claim limita-
tions because they require human intervention in deter-
mining whether to apply rules in particular situations.
The asserted claims require that a “processor cause the
system to: . . . generate . . . one or more rules” and “provi-
sion a device . . . with the one or more rules.” ’176 patent,
claim 11. The specification further explains that the
“packet correlator . . . may generate or update rule(s)” and
“may provision [a] device . . . with rules.” Id., col. 13
ll. 14–19. The specification thus contemplates that the
rules are automatically executed by the processor.
7 At the Rule 63 hearing, Centripetal seemed to
agree that its arguments based on proxy data required “a
different claim construction.” J.A. 21464.
Case: 24-2097 Document: 62 Page: 18 Filed: 04/29/2026

-- 18 of 19 --

CENTRIPETAL NETWORKS, LLC v. CISCO SYSTEMS, INC. 19
Stealthwatch does not issue rules, as the term was con-
strued to require “a condition or set of conditions that
when satisfied cause a specific function to occur.” J.A. 9.
Rather, as the district court found, Stealthwatch only
issues alerts which advise individuals of potentially
problematic situations. A human administrator must
examine these alerts and determine whether to respond
by issuing a quarantine tag. The district court did not
clearly err in finding Cisco’s technology does not perform
these limitations of the asserted claims.
CONCLUSION
We conclude that the asserted claims of the
’193 patent require filtering data at two stages, and the
district court did not err in concluding that Cisco’s ac-
cused products only perform filtering at the first stage.
As to the ’806 patent, we conclude that “responsive to”
requires that the claimed signal be the but-for cause of
“ceas[ing] processing” packets and, under this construc-
tion, the district court did not err in concluding that
Cisco’s accused products do not infringe the asserted
claims. We also conclude that the district court did not
err in concluding that Cisco’s products do not perform
every limitation of the asserted claims of the ’176 patent.
Accordingly, we affirm.
AFFIRMED
COSTS
Costs to Cisco.
Case: 24-2097 Document: 62 Page: 19 Filed: 04/29/2026

-- 19 of 19 --