CN116708148B

CN116708148B - Network diagnosis method and electronic equipment

Info

Publication number: CN116708148B
Application number: CN202211711355.2A
Authority: CN
Inventors: 黄子岩; 李瑾; 张光华
Original assignee: Honor Device Co Ltd
Current assignee: Honor Device Co Ltd
Priority date: 2022-12-29
Filing date: 2022-12-29
Publication date: 2024-04-02
Anticipated expiration: 2042-12-29
Also published as: CN116708148A

Abstract

The application discloses a network diagnosis method and electronic equipment, which relate to the technical field of communication and comprise the following steps: the routing equipment counts first handshake time delay and second handshake time delay of a transmission layer control protocol (TCP) connection between the terminal and the network equipment, and the routing equipment determines the first network equipment with the first handshake time delay larger than a first time delay threshold value for establishing the TCP connection and the first terminal with the second handshake time delay larger than a second time delay threshold value for establishing the TCP connection. The routing equipment carries out ping detection on the first network equipment, acquires the network state between the routing equipment and the first network equipment, and carries out ping detection on the first terminal, and acquires the network state between the routing equipment and the first terminal. In the application, under the condition that the fact that handshake round trip time delay is overtime exists between the terminal and the network equipment is determined, ping detection is carried out on the first network equipment and the first terminal, network equipment which causes slow network is further determined, network optimization is carried out on the network equipment, and user experience is improved.

Description

Network diagnosis method and electronic equipment

Technical Field

The present disclosure relates to the field of communications technologies, and in particular, to a network diagnosis method and an electronic device.

Background

The routing equipment is responsible for connecting hardware equipment of two or more networks, stores and forwards data packets among different networks according to destination addresses of the data packets of the different networks, and plays a role of a gateway among the networks.

In the scenario that the terminal is connected to the network through the routing device, the routing device can read the address in the data packet of the terminal and then forward the data packet to the device corresponding to the address. The routing device may also read addresses in the data packets of devices of other networks and forward the data packets to the terminal corresponding to the addresses.

Because the network topology of the terminal surfing the internet through the routing equipment involves a plurality of different types of network equipment, if network blocking and slow surfing are caused by network faults in the terminal surfing process, even the problem that the network cannot be connected is solved, the abnormal network equipment is difficult to locate in the prior art, and therefore user experience is affected.

Disclosure of Invention

The embodiment of the application provides a network diagnosis method and electronic equipment, wherein a routing device sends a test instruction to wide area network equipment or local area network equipment under the condition that handshake round trip delay time-out exists between a terminal and the network equipment, so that network abnormal equipment is further determined, and the abnormal equipment causing slow network or abnormal network can be more accurately positioned, thereby optimizing and improving the abnormal equipment and improving user experience. In order to achieve the above purpose, the embodiments of the present application adopt the following technical solutions.

In a first aspect, a network diagnostic method is provided, the method comprising:

the method comprises the steps that a routing device counts first handshake delay and second handshake delay of a transmission layer control protocol (TCP) connection established between a terminal and a network device; the first handshake delay is the delay between the sending of handshake request information to the network equipment by the routing equipment and the receiving of handshake response information corresponding to the handshake request information from the network equipment by the routing equipment; the second handshake delay is the delay between the sending of handshake response information to the terminal by the routing equipment and the receiving of handshake acknowledgement information corresponding to the handshake response information from the terminal by the routing equipment; the handshake request information is used for requesting the terminal to establish TCP connection with the network equipment;

the routing equipment determines a first network equipment and a first terminal; the first network device is a network device with a first handshake time delay greater than a first time delay threshold for establishing a TCP connection; the first terminal is a terminal with a second handshake time delay greater than a second time delay threshold for establishing TCP connection;

the routing equipment carries out ping detection on the first network equipment to acquire a network state between the routing equipment and the first network equipment; network status includes network normal, network delay, or network disconnection;

and the routing equipment carries out ping detection on the first terminal to acquire the network state between the routing equipment and the first terminal.

In the application, if the condition of slow network occurs in the terminal internet surfing process, the routing equipment can count the first handshake delay and the second handshake delay of establishing the transmission layer control protocol (TCP) connection between the terminal and the network equipment. And under the condition that the first handshake time delay of the first network equipment is larger than a first time delay threshold, the routing equipment carries out ping detection on the first network equipment, and the network state between the routing equipment and the first network equipment is obtained. And performing ping detection on the first terminal to acquire the network state between the routing equipment and the first terminal when the second handshake time delay of the first terminal is determined to be larger than a second time delay threshold. By performing ping detection on the first network device and the first terminal to perform secondary confirmation of the network state, the abnormal network device can be effectively and accurately determined. In addition, the network diagnosis method is real-time detection under the condition that a user does not feel, and in the process that the user actually uses the network, the routing equipment can report the network state between the routing equipment and the network equipment to the server, so that technicians can timely feed back and optimize the network, and the Internet surfing experience of the user is further optimized.

With reference to the first aspect, in one possible design manner, the method further includes:

the routing equipment generates corresponding handshake interaction information for each terminal; the handshake interaction information comprises the identification of the terminal and the identification of network equipment which establishes TCP connection with the terminal; the method comprises the steps that a routing device records a first handshake time delay corresponding to first network equipment in handshake interaction information of a terminal corresponding to the first network equipment; the routing equipment records a second handshake time delay corresponding to the first terminal in handshake interaction information of the first terminal.

In the application, the routing device may generate corresponding handshake interaction information for each terminal, which is used to record information related to the process of establishing a TCP connection between the terminal and the corresponding network device, such as the first handshake delay and the second handshake delay, where the data may provide effective data support for the routing device to perform subsequent ping detection.

With reference to the first aspect, in one possible design manner, the routing device performs ping detection on the first network device, including: the routing device sends a ping instruction to the first network device according to a first period. The routing device performs ping detection on the first terminal, including: the routing device sends a ping instruction to the first terminal according to the first period.

In the application, the routing device may send a ping instruction to the first network device and the first terminal according to the first period, where ping is a method for determining whether the local device can successfully exchange a data packet with another device, and may quickly and effectively confirm the network states between the routing device and the network device, and between the routing device and the terminal.

With reference to the first aspect, in one possible design manner, acquiring a network state between the routing device and the first network device includes:

if the routing device does not receive the response of the first network device to the ping instruction within the first time period after the routing device sends the ping instruction, the routing device determines that the network state between the routing device and the first network device is network disconnection.

In the application, the routing device does not receive the response of the first network device to the ping instruction within a first duration after sending the ping instruction to the first network device, which indicates that the network of the first network device has a fault and the response of the ping instruction is not made in time, and in this case, the routing device determines that the network state between the routing device and the first network device is network disconnection. The network state is judged by responding to the time delay, and the scheme can quickly and accurately determine the network state between the routing equipment and the first network equipment.

if the routing equipment receives a response of the first network equipment to the ping instruction within a first time period after sending the ping instruction; the routing equipment acquires a first response time delay from sending the ping instruction to receiving a response of the first network equipment aiming at the ping instruction; if the routing device determines that the first response delay is greater than the first threshold, the routing device determines that the network state between the routing device and the first network device is a network delay.

In the application, the routing device receives the response of the first network device within the first time period, acquires the first response time delay, determines whether the first response time delay has a delay according to the first threshold value, and if the first response time delay is greater than the first threshold value, the routing device determines that the network state between the routing device and the first network device is the network delay. The network state is judged by responding to the time delay, and the scheme can quickly and accurately determine the network state between the routing equipment and the first network equipment.

If the routing equipment receives a response of the first network equipment to the ping instruction within a first time period after sending the ping instruction; the routing equipment acquires a first response time delay from sending the ping instruction to receiving a response of the first network equipment aiming at the ping instruction; if the routing device determines that the first response delay is less than the first threshold, the routing device determines that the network state between the routing device and the first network device is network normal.

In the application, if the first response time delay is smaller than the first threshold, it is indicated that the routing device receives the first response time delay according to the response speed when the network is normal. In this case, the routing device determines that the network state between the routing device and the first network device is network normal. The network state is judged by responding to the time delay, and the scheme can quickly and accurately determine the network state between the routing equipment and the first network equipment.

With reference to the first aspect, in one possible design manner, the first network device includes a first probe server and a second probe server,

the routing device sends a ping instruction to the first network device according to a first period, including:

the routing equipment respectively sends a ping instruction to a first detection server and a second detection server according to a first period;

The obtaining a network state between the routing device and the first network device includes:

if the routing device does not receive the response of the first detection server and the second detection server to the ping instruction within a first time period after the routing device sends the ping instruction, the routing device determines that the network state between the routing device and the first network device is network disconnection.

The second probe server can be used as a standby server of the first probe server. And when the routing equipment does not receive the response returned by the first detection server and receives the response returned by the second detection server, determining that the first detection server is abnormal, but the network state between the routing equipment and the first network equipment is that the network is not disconnected.

In the application, the routing device does not receive the responses of the first detection server and the second detection server to the ping instruction within a first time period after sending the ping instruction to the first detection server and the second detection server, which indicates that the networks of the first detection server and the second detection server have faults and do not timely make the response of the ping instruction, and in this case, the routing device determines that the network state between the routing device and the first detection server and the second detection server is network disconnection. By responding to the time delay to judge the network state, the scheme can rapidly and accurately determine the network state between the routing equipment and the first detection server and the second detection server.

the routing equipment generates a first network identifier according to the network state between the routing equipment and the first network equipment; the routing equipment records a first network identification in handshake interaction information of a terminal corresponding to the first network equipment.

In the application, the routing device records the first network identifier representing the network state between the routing device and the first network device in the handshake interaction information of the terminal corresponding to the first network device, and the data can provide effective data support for the routing device to judge the network state between the routing device and the first network device.

With reference to the first aspect, in one possible design manner, acquiring a network state between the routing device and the first terminal includes:

if the routing equipment does not receive the response of the first terminal to the ping instruction within the second time after the sending of the ping instruction, the routing equipment determines that the network state between the routing equipment and the first terminal is network disconnection.

In the application, the routing device does not receive the response of the first terminal to the ping instruction within a first time period after sending the ping instruction to the first terminal, which indicates that the network of the first terminal has a fault and does not timely respond to the ping instruction, and in this case, the routing device determines that the network state between the routing device and the first terminal is network disconnection. The network state is judged by responding to the time delay, and the scheme can rapidly and accurately determine the network state between the routing equipment and the first terminal.

if the routing equipment receives the response of the first terminal to the ping instruction within a second time period after sending the ping instruction; the routing equipment acquires a second response time delay from sending the ping instruction to receiving the response of the first terminal to the ping instruction; if the routing device determines that the second response delay is greater than the second threshold, the routing device determines that the network state between the routing device and the first terminal is a network delay.

In the present application, the routing device receives the response of the first terminal within the second duration, acquires the second response delay, determines whether the second response delay has a delay according to the second threshold, and if the second response delay is greater than the second threshold, in this case, the routing device determines that the network state between the routing device and the first terminal is the network delay. The network state is judged by responding to the time delay, and the scheme can rapidly and accurately determine the network state between the routing equipment and the first terminal.

If the routing equipment receives the response of the first terminal to the ping instruction within a second time period after sending the ping instruction; the routing equipment acquires a second response time delay from sending the ping instruction to receiving the response of the first terminal to the ping instruction; if the routing device determines that the second response time delay is smaller than the second threshold value, the routing device determines that the network state between the routing device and the first terminal is normal.

In the application, if the second response time delay is smaller than the second threshold, it is indicated that the routing device receives the second response time delay according to the response speed when the network is normal. In this case, the routing device determines that the network state between the routing device and the first terminal is network normal. The network state is judged by responding to the time delay, and the scheme can rapidly and accurately determine the network state between the routing equipment and the first terminal.

the routing equipment generates a second network identifier according to the network state between the routing equipment and the first terminal; the routing equipment records a second network identifier in handshake interaction information corresponding to the first terminal.

In the application, the routing device records the second network identifier representing the network state between the routing device and the first terminal in the handshake interaction information of the first terminal, and the data can provide effective data support for the routing device to judge the network state between the routing device and the first terminal.

if the routing equipment determines that the first terminal is a wireless internet terminal, acquiring a first communication parameter of the first terminal; the first communication parameters comprise network port identification, wireless signal strength, receiving rate and sending rate; the routing equipment records a first communication parameter in handshake interaction information corresponding to the first terminal.

In this application, when the first terminal is a wireless internet terminal, the routing device may further record the first communication parameter of the first terminal in the first handshake interaction information of the first terminal. Effective data support is provided for network state analysis between the routing device and the first terminal.

if the routing equipment determines that the first terminal is a wired network terminal, acquiring second communication parameters of the first terminal; the second communication parameters comprise a network port identifier and a local area network address of the terminal; the routing equipment records second communication parameters in handshake interaction information corresponding to the first terminal.

In this application, when the first terminal is a wired internet terminal, the routing device may further record the second communication parameter of the first terminal in the first handshake interaction information of the first terminal. Effective data support is provided for network state analysis between the routing device and the first terminal.

the routing equipment sends a test instruction to the second terminal according to the second period; the second terminal is any one of the terminals; if the routing equipment does not receive the test response of the second terminal to the test instruction within the third time after the test instruction is sent, the routing equipment records the first identifier in handshake interaction information of the second terminal; the first identifier is used for indicating that the second terminal and the routing equipment do not establish communication connection; if the routing equipment receives a test response of the second terminal aiming at the test instruction in the first time period, the routing equipment records a second identifier in handshake interaction information of the second terminal; the second identifier is used to indicate that the second terminal establishes a communication connection with the routing device.

In the application, the routing device may further send a test instruction to each of the plurality of terminals, for detecting whether each terminal establishes a connection with the routing device, that is, detecting whether each terminal is in an online state. If the second terminal establishes connection (works on line) with the routing device, recording a second identifier in handshake interaction information of the second terminal; if the second terminal does not establish a connection with the routing device (the operation is not on-line), the first identifier is recorded in handshake interaction information of the second terminal.

In the application, the routing equipment can perform centralized management on the working on-line or working off-line state of each terminal based on the test instruction, so that the actual working state of each terminal can be conveniently obtained.

the routing device sends handshake interaction information to the server according to the third period.

In the application, the routing device can send the stored handshake interaction information to the server according to the third period so as to reduce the interaction cost with the server. And sending handshake interaction information to the server, wherein the server determines a first delay threshold and a second delay threshold based on the handshake interaction information, and the routing equipment can judge communication delay based on the first delay threshold and the second delay threshold.

With reference to the first aspect, in one possible design manner, before the routing device performs ping detection on the first network device, the method further includes:

the routing device determines that a dial-up connection is established between the routing device and the first network device.

In this application, the routing device needs to determine that a dial-up connection is established between the routing device and the first network device before ping the first network device. If the routing device does not establish dial-up connection with the first network device, the network is not enabled, that is, the ping detection result is that the network is disconnected. In case it is determined that a dial-up connection is established between the routing device and the first network device, the actual network state of the routing device and the first network device may only be detected by performing a ping detection on the first network device.

if the routing equipment determines that the network state between the routing equipment and the first network equipment is network delay or network disconnection, the routing equipment generates first network abnormality prompt information; the first network abnormality prompting information is used for prompting a user that network abnormality exists in the first network equipment; the routing equipment sends first network abnormality prompt information to the terminal.

In the application, the routing device can send the first network abnormality prompting information to the terminal under the condition that the network state between the routing device and the first network device is determined to be network delay or network disconnection, so as to remind the user that the first network device has network abnormality, prompt the user of the current network state in time and optimize the user experience.

if the routing equipment determines that the network state between the routing equipment and the first terminal is network delay or network disconnection, the routing equipment generates second network abnormality prompt information; the second network abnormality prompting information is used for prompting the user that the first terminal has network abnormality; the routing equipment sends second network abnormity prompt information to the first terminal.

In the application, the routing device can send the second network abnormality prompting information to the terminal under the condition that the network state between the routing device and the first terminal is determined to be network delay or network disconnection, so as to remind the user that the first terminal has network abnormality, prompt the user of the current network state in time and optimize the user experience.

In a second aspect, a network diagnostic method is provided, comprising:

the server receives a plurality of handshake interaction information from the routing device; the handshake interaction information comprises a terminal identifier, an identifier of a network device establishing TCP connection with the terminal, a first network identifier and a second network identifier; the first network identifier is used for representing a network state between the routing device and the network device; the second network identifier is used for representing the network state between the routing equipment and the terminal; network status includes network normal, network delay, or network disconnection; the server analyzes the handshake interaction information to obtain fault information of the handshake interaction information; the fault information comprises a fault grade and a fault reason; and outputting handshake interaction information and fault information corresponding to the handshake interaction information by the server.

In the application, the server receives a plurality of handshake interaction information, and the first network identifier and the second network identifier determine the fault level and the fault reason corresponding to each terminal according to the terminal identifier in the handshake interaction information and the identifier of the network device establishing TCP connection with the terminal, so that the fault level and the fault reason of each terminal are output. The fault level and the fault reason of each terminal are provided for maintenance personnel, so that the maintenance personnel can conduct network optimization in a targeted manner, and the Internet surfing experience of users is improved.

With reference to the second aspect, in one possible design manner, the server analyzes each handshake interaction information to obtain fault information of each handshake interaction information, including:

the server determines the network state of the network equipment corresponding to the routing equipment and the first handshake interaction information according to the first network identification of the first handshake interaction information; the first handshake interaction information is any one of a plurality of handshake interaction information; and the server acquires the fault grade and the fault reason corresponding to the first handshake interaction information according to the network states of the routing equipment and the first network equipment.

In the application, the server determines the network state of the first network device corresponding to the first handshake interaction information according to the first network identifier of the first handshake interaction information, so as to determine the fault level and the fault reason of the first handshake interaction information, and further output the fault level and the fault reason of the first handshake interaction information. The failure level and the failure reason of the first handshake interaction information are provided for the maintainer, so that the maintainer can perform network optimization aiming at the network corresponding to the first handshake interaction information, and the Internet surfing experience of the user is improved.

The server determines the network states of the first terminal and the routing equipment corresponding to the second handshake interaction information according to the second network identification of the second handshake interaction information; and the server acquires the fault grade and the fault reason corresponding to each second handshake interaction information according to the network states of the first terminal and the routing equipment.

In the application, the server determines the network state of the first terminal corresponding to the second handshake interaction information according to the second network identifier of the second handshake interaction information, so as to determine the fault level and the fault reason of the second handshake interaction information, and further output the fault level and the fault reason of the second handshake interaction information. The failure level and the failure reason of the second handshake interaction information are provided for the maintainer, so that the maintainer can perform network optimization aiming at the network corresponding to the second handshake interaction information, and the Internet surfing experience of the user is improved.

With reference to the second aspect, in one possible design manner, the handshake interaction information further includes a first handshake delay, where the first handshake delay is a delay between when the routing device sends handshake request information to the network device and when the routing device receives handshake response information from the network device; the handshake request information is used for requesting the terminal to establish TCP connection with the network equipment; the method further comprises the steps of:

The server orders the first handshake time delays in the plurality of handshake interaction information from small to large, and the server determines the ordered Nth first handshake time delay as a first time delay threshold; wherein N is a first preset value, N is greater than 0 and less than or equal to a preset number; the first delay threshold is used for judging whether communication delay abnormality exists between the routing equipment and the network equipment by the routing equipment.

In the application, the server can determine the first delay threshold from the plurality of first handshake delays according to the determination principle of the preset value, and the obtained first delay threshold is more in line with the actual network environment of the terminal, so that the judgment of the communication delay between the routing equipment and the network equipment is more accurate.

With reference to the second aspect, in one possible design manner, the handshake interaction information further includes a second handshake delay, where the second handshake delay is a delay between when the routing device sends handshake response information to the terminal and when the routing device receives handshake acknowledgement information from the terminal; the method further comprises the steps of:

the server sorts the second handshake time delay in the handshake interaction information from small to large, and the server determines the value of the M second handshake time delay after sorting as a second time delay threshold; m is a second preset value, and M is greater than 0 and less than or equal to the preset number; the second time delay threshold is used for judging whether communication time delay abnormality exists between the routing equipment and the terminal by the routing equipment.

In the application, the server can determine the second time delay threshold from the plurality of second handshake time delays according to the determination principle of the preset value, and the obtained second time delay threshold is more in line with the actual network environment of the terminal, so that the judgment of the communication time delay between the routing equipment and the terminal is more accurate.

With reference to the second aspect, in one possible design manner, the handshake interaction information further includes a first response delay, where the first response delay is a duration between when the routing device sends the first test instruction to the network device and when the routing device receives the first test response for the first test instruction; the method further comprises the steps of:

the server sorts the first response time delays in the handshake interaction information from small to large, and the server determines the value of the sorted P first response time delays as a first threshold; wherein P is a first preset value, P is greater than 0 and less than or equal to a preset number; the first threshold is used for judging whether a test response abnormality exists between the routing equipment and the network equipment by the routing equipment.

In the application, the server can determine the first threshold value from the plurality of first response time delays according to the determination principle of the preset value, and the obtained first threshold value is more in accordance with the actual network state of the interaction of the routing equipment and the network equipment, so that the judgment of the network state between the routing equipment and the network equipment is more accurate.

With reference to the second aspect, in one possible design manner, the handshake interaction information further includes a second response delay, where the second response delay is a duration between when the routing device sends the second test instruction to the terminal and when the routing device receives the second test response for the second test instruction; the method further comprises the steps of:

the server sorts the second response time delays in the handshake interaction information from small to large, and the server determines the value of the sorted Q-th second response time delay as a second threshold value; q is a first preset value, Q is greater than 0 and less than or equal to a preset number; the second threshold is used for judging whether the test response abnormality exists between the routing equipment and the terminal by the routing equipment.

In the application, the server can determine the second threshold from the plurality of second response delays according to the determination principle of the preset value, and the obtained second threshold is more in accordance with the actual network state of the interaction between the routing equipment and the terminal, so that the judgment of the network state between the routing equipment and the terminal is more accurate.

With reference to the second aspect, in one possible design manner, the method further includes:

the server sends the first delay threshold, the second delay threshold, the first threshold and the second threshold to the routing equipment.

In the application, the server may send the determined first delay threshold, the second delay threshold, the first threshold and the second threshold to the routing device, where the first delay threshold is a basis for the routing device to determine whether the first handshake delay between the routing device and the network device is overtime, and the second delay threshold is a basis for the routing device to determine whether the second handshake delay between the routing device and the terminal is overtime; the first threshold is the basis for judging the network delay between the routing equipment and the network equipment by the routing equipment, and the second threshold is the basis for judging the network delay between the routing equipment and the terminal by the routing equipment, so that the routing equipment can rapidly and accurately acquire the network information between the routing equipment and the network equipment and between the routing equipment and the terminal. And the first delay threshold, the second delay threshold, the first threshold and the second threshold are all determined by dynamically adjusting the first handshake delay, the second handshake delay, the first response delay and the second response delay in the plurality of handshake interaction information by the server, and the first delay threshold, the second delay threshold, the first threshold and the second threshold have higher scene accuracy.

In a third aspect, an electronic device is provided that includes a memory, a display screen, and one or more processors; the memory, the display screen and the processor are coupled; the memory has stored therein computer program code comprising computer instructions which, when executed by the processor, cause the electronic device to perform the method of any of the first or second aspects described above.

In a fourth aspect, there is provided a computer readable storage medium having instructions stored therein which, when run on an electronic device, cause the electronic device to perform the method of any of the first aspects described above.

In a fifth aspect, there is provided a computer program product comprising instructions which, when run on an electronic device, cause the electronic device to perform the method of any of the first or second aspects above.

In a sixth aspect, embodiments of the present application provide a chip comprising a processor for invoking a computer program in a memory to perform the method according to any of the first or second aspects.

It will be appreciated that the advantages achieved by the electronic device according to the third aspect, the computer readable storage medium according to the fourth aspect, the computer program product according to the fifth aspect, and the chip according to the sixth aspect may refer to the advantages of the first aspect or the second aspect and any of the possible designs thereof, and will not be repeated here.

Drawings

Fig. 1 is a schematic diagram of a router networking topology according to an embodiment of the present application;

Fig. 2 is a schematic diagram of a network architecture of a network diagnosis method according to an embodiment of the present application;

fig. 3 is a schematic architecture diagram of a router according to an embodiment of the present application;

fig. 4 is a schematic diagram of a networking topology combined with a router module structure according to an embodiment of the present application;

FIG. 5 is a schematic diagram of a network architecture of another network diagnosis method according to an embodiment of the present application;

FIG. 6 is a flowchart of a network diagnosis method for interaction between internal modules of a router according to an embodiment of the present application;

fig. 7 is a schematic diagram of TCP three-way handshake interaction between a terminal and a server according to an embodiment of the present application;

fig. 8 is a schematic diagram of TCP three-way handshake interaction between a terminal and a server through a router according to an embodiment of the present application;

FIG. 9 is a schematic diagram of an iptables call chain data flow in a router kernel according to an embodiment of the present application;

fig. 10 is a schematic diagram of an iptables call chain monitoring handshake message in a router kernel according to an embodiment of the present application;

fig. 11 is a schematic diagram of setting a listening point in a process of performing TCP three-way handshake between a terminal and a server through a router according to an embodiment of the present application;

fig. 12 is a schematic process diagram of a method for determining a delay by a router according to an embodiment of the present application;

Fig. 13 is a schematic process diagram of a method for dynamically adjusting a delay threshold of a router according to an embodiment of the present application;

fig. 14 is a schematic process diagram of another method for determining a delay of a router according to an embodiment of the present application

Fig. 15 is a schematic diagram of a router ping peripheral device according to an embodiment of the present application;

fig. 16 is a flowchart of a router ping detection method provided in an embodiment of the present application;

fig. 17 is an environmental architecture diagram of a router reporting information to an analysis server according to an embodiment of the present application;

fig. 18 is an interaction schematic diagram of a router sending reminder information to a terminal according to an embodiment of the present application;

fig. 19 is a schematic structural diagram of an electronic device according to an embodiment of the present application;

fig. 20 is a schematic structural diagram of a chip system according to an embodiment of the present application.

Detailed Description

In the description of the embodiments of the present application, the terminology used in the embodiments below is for the purpose of describing particular embodiments only and is not intended to be limiting of the present application. As used in the specification of this application and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include, for example, "one or more" such forms of expression, unless the context clearly indicates to the contrary. It should also be understood that in the various embodiments herein below, "at least one", "one or more" means one or more than two (including two). The term "and/or" is used to describe an association relationship of associated objects, meaning that there may be three relationships; for example, a and/or B may represent: a alone, a and B together, and B alone, wherein A, B may be singular or plural. The character "/" generally indicates that the context-dependent object is an "or" relationship.

Reference in the specification to "one embodiment" or "some embodiments" or the like means that a particular feature, structure, or characteristic described in connection with the embodiment is included in one or more embodiments of the application. Thus, appearances of the phrases "in one embodiment," "in some embodiments," "in other embodiments," and the like in the specification are not necessarily all referring to the same embodiment, but mean "one or more but not all embodiments" unless expressly specified otherwise. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless expressly specified otherwise. The term "coupled" includes both direct and indirect connections, unless stated otherwise. The terms "first," "second," and the like are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated.

In the embodiments of the present application, words such as "exemplary" or "such as" are used to mean serving as examples, illustrations, or descriptions. Any embodiment or design described herein as "exemplary" or "for example" should not be construed as preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "such as" is intended to present related concepts in a concrete fashion.

In the scene that the terminal is connected with the network through the routing equipment, because equipment of different types of networks is involved in the networking topology, if network blocking and slow surfing are caused by network faults in the terminal surfing process, even the problem that the network cannot be connected is solved, the abnormal equipment of the network is difficult to locate in the prior art, and therefore user experience is affected.

Fig. 1 shows a schematic diagram of a common networking topology. Fig. 1 includes a terminal (e.g., a wireless internet device and a wired internet device), a routing device (e.g., a router), and a network device (e.g., a broadband access server (broadband remote access server, BRAS), a core router, a core network device, etc.). Optionally, an optical modem (e.g., optical cat) may also be included in the networking topology. The optical modem is used for realizing the conversion of the photoelectric signals and the conversion of the interface protocol in the wide area network and is connected with the network equipment and the routing equipment. The routing device connects the terminal with the optical modem to realize the connection of the local area network to the wide area network. The routing equipment enables a plurality of terminals to simultaneously use the network through the same network so as to play a role of network distribution. As shown in fig. 1, the routing device connects the terminal with the optical modem, the optical modem is connected with the broadband access server, the core router connects the broadband access server with the network device, and a networking topology structure of the terminal-the routing device-the optical modem-the broadband access server-the core router-the network device is formed, so that the requirement of the terminal for accessing the wide area network is met. The terminal comprises wireless internet equipment and wired internet equipment. The wireless internet equipment can be accessed to the routing equipment in a wireless mode, and the wired internet equipment can be accessed to the routing equipment in a wired internet mode. The routing device is used for transmitting messages between the terminal and the network device.

In the networking topology shown in fig. 1, a plurality of terminals (wireless internet access device and wired internet access device) connected to the same routing device are in the same local area network (local area network, LAN), and the plurality of terminals are called local area network devices. Network devices that are in different networks are referred to as wide area network (wide area network, WAN) devices. In the case that network jam and slow surfing are caused by network faults in the terminal surfing process and even a network cannot be connected, the prior art is difficult to locate which specific equipment is abnormal in the network.

The present application provides a network diagnosis method, which can be used for the networking topology structure shown in fig. 1. The routing equipment can determine the specific equipment with faults by monitoring the interaction information of the terminal and the service side in the communication process.

In some embodiments, the terminal may be a portable computer (e.g., a cell phone), a tablet computer, a notebook computer, a personal computer (personal computer, PC), a wearable electronic device (e.g., a smart watch), a smart sound, a smart home appliance, an augmented reality (augmented reality, AR) \virtual reality (VR) device, a vehicle computer, or the like. The network device may be a server, a cluster of servers, etc. that provide web services. The embodiment of the present application is not particularly limited to a specific form.

Taking the terminal as a mobile phone and the routing device as a router as an example. The user can use the mobile phone to access the resources such as websites, emails, data and the like provided by the application server. The mobile phone accesses the resource of the application server, and data interaction can be carried out between the mobile phone and the application server. The interaction of data between a handset (client) and an application server (server) requires the establishment of a connection-like channel at the transport layer, i.e. a transmission control protocol (transmission control protocol, TCP) connection. The process of establishing a TCP connection is also referred to as a three-way handshake.

According to the network diagnosis method, the router can monitor the three-way handshake message of the terminal and the server. The time difference between the time when the router monitors that the terminal sends the first handshake message to the server and the time when the router monitors that the server sends the second handshake message to the terminal is the handshake round-trip time delay (first handshake round-trip time delay for short) between the first handshake message and the second handshake message. The time difference between the time when the router monitors that the server sends the second handshake message to the terminal and the time when the router monitors that the terminal sends the third handshake message to the server is the handshake round-trip time delay (second handshake round-trip time delay for short) between the second handshake message and the third handshake message. The first handshake round trip delay is the delay of a router forwarding a data packet to a server in a wide area network, and can be understood as the delay of a WAN side; the second handshake round-trip delay is the delay of the router forwarding the data packet to the LAN terminal, and can be understood as LAN side delay. The router can determine whether the WAN side delay has time delay overtime or the LAN side delay has time delay overtime according to the WAN side delay and the corresponding delay threshold value, the LAN side delay and the corresponding delay threshold value, so as to determine whether the WAN side equipment is abnormal or the LAN side equipment is abnormal, and the effect of positioning the abnormal equipment is achieved. Furthermore, after determining that the WAN side equipment is abnormal or the LAN side equipment is abnormal, the router may report the equipment abnormality information to the server, so that the server performs abnormality analysis according to the equipment abnormality information, thereby facilitating maintenance personnel to perform network optimization.

In some embodiments, a schematic diagram of a network architecture to which the network diagnosis method provided in the embodiments of the present application is applicable is given in connection with fig. 2. As shown in fig. 2, the network architecture includes a terminal, a router, and a network device. The network equipment comprises a detection server, an analysis server and other servers. Wherein the router may determine whether the router itself is abnormal by communicating with the probe server. For example, when the terminal is abnormal in surfing the internet, the router may send a detection data packet to the probe server, and if the detection data packet returned by the probe server can be received, it is determined that the router is normal. In this embodiment, the probe server is a preselected server, in this embodiment, the network of the probe server is determined to be normal, the probe server is used as a detection object of the routing device, the routing device sends a detection data packet to the probe server, and if the data packet is not received, the routing device is considered to be abnormal. The analysis server is responsible for carrying out exception analysis according to the equipment exception information reported by the router.

Illustratively, the path labeled 1 in fig. 2 is used to illustrate that when the terminal performs internet surfing, the router uploads the handshake message, monitors the handshake message sent by the terminal, records the time of receiving the handshake message and the transmission direction of the handshake message, and forwards the handshake message to the corresponding network device. Correspondingly, when the network device issues the handshake message through the router, the router monitors the handshake message sent by the network device, records the time of receiving the handshake message and the transmission direction of the handshake message, and forwards the handshake message to the corresponding terminal. In the three-way handshake scenario between the terminal and the network device, the router may obtain a first handshake round-trip delay (WAN side delay) and a second handshake round-trip delay (LAN side delay) between the terminal and the network device. The router can determine whether the WAN side delay has time delay timeout or the LAN side delay has time delay timeout according to the WAN side delay and the corresponding delay threshold value, the LAN side delay and the corresponding delay threshold value, so as to determine whether the WAN side equipment is abnormal or the LAN side equipment is abnormal. For example, if the WAN side delay is greater than the WAN side delay threshold, determining that the WAN side device may have a network anomaly; if the LAN side delay is greater than the LAN side delay threshold, it is determined that the LAN side device may have a network anomaly. Alternatively, the router may report the network anomaly information to the analysis server. Such as the path labeled 5 in fig. 2.

In some embodiments, the router determines that it is the LAN side device that is causing the network to be slow, further the router may determine which device is on the LAN side at all that there is an anomaly by sending test instructions to the LAN side device. As in the path labeled 3 in fig. 2, the router may send test instructions to each terminal to determine the terminals with network anomalies based on the test responses of each terminal. The router determines what is the WAN side device that is causing the network to be slow, and further, the router may determine which device is the WAN side at all that has an anomaly by sending test instructions to the WAN side device. As in the path labeled 4 in fig. 2, the router sends test instructions to the network device and the probe server to determine the device with network anomalies based on the test responses of the network device and the probe server. Optionally, the router may generate network anomaly report information after determining, based on the test instruction, that a certain device has an anomaly, and report the network anomaly report information to the analysis server, such as path labeled 5 in fig. 2.

In some embodiments, the router may also generate a network anomaly prompt message, and send the network anomaly prompt message to the terminal, such as the path labeled 6 in fig. 2. The network anomaly prompt information can include a reason for network slowness and a suggestion for improving an optimized network.

In some embodiments, fig. 3 provides an architectural diagram of a router. The router comprises a hardware module, a driving module, a processor and the like. The hardware module comprises radio frequency hardware, a network port device (LAN side), a network port device (WAN side) and the like; the drive module comprises a wireless drive (Wi-Fi drive), a network port drive (wired) and the like. The wireless internet access device comprises a router, a Wi-Fi driver, a wireless internet access device and a wireless internet access device, wherein radio frequency hardware in the router and the Wi-Fi driver realize connection of the router and the wireless internet access device; the network port device (LAN side) and the network port driver in the router realize the connection between the router and the wired internet equipment. The network port device (WAN side) of the router and the network port driver realize the connection of the router and the network equipment in the wide area network. The kernel processor of the router realizes message monitoring, address conversion and data processing.

In connection with the networking topology presented in fig. 1 and the hardware architecture of the router presented in fig. 3, fig. 4 presents a schematic diagram of a more detailed terminal communicating with a network device through the router. In fig. 4, a core processor of the router includes an IP protocol stack and a listening module; the router also comprises a diagnosis module, a processing module and a management module of the application layer.

The terminal comprises wireless internet equipment and wired internet equipment. The wireless internet device is connected with the router through radio frequency hardware and Wi-Fi drive in the router. The wired internet equipment is connected with the router through a network port device (LAN side) and a network port driver. Network equipment in the wide area network is connected with a router through a network port device (WAN side) and a network port driver.

In the process that the terminal sends the handshake message to the router, the router monitors the handshake message sent by the terminal and records the time of receiving the handshake message, the transmission direction of the handshake message and other information. And forwarding the handshake message to the optical modem, and sending the handshake message to the corresponding operator core network by the optical modem. The handshake message finally reaches the network device through the broadband access server and the core router. In the process of sending out the handshake message by the network equipment, the handshake message passes through the broadband access server, the core router and the optical modem to reach the router, and the router monitors the handshake message sent by the network equipment and records the time of receiving the handshake message, the transmission direction of the handshake message and other information. And then forwards the handshake message to the terminal. Thereby realizing handshake message transmission between the terminal and the network equipment through the router.

The following description is made in connection with each functional module of the router:

the monitoring module of the router is used for monitoring the handshake message sent by the terminal, recording the time for receiving the handshake message and the transmission direction of the handshake message, and forwarding the handshake message to the corresponding network equipment; monitoring a handshake message sent by the network equipment, recording the time for receiving the handshake message and the transmission direction of the handshake message, and forwarding the handshake message to a corresponding terminal. And the monitoring module is also used for generating an information flow record comprising the terminal and the network equipment according to handshake interaction between the terminal and the network equipment. The information flow record includes information such as time of sending a first handshake message to the network device by the terminal and transmission direction of the handshake message, time of sending a second handshake message to the terminal by the network device and transmission direction of the handshake message, time of sending a third handshake message to the network device by the terminal and transmission direction of the handshake message.

And the processing module of the router is used for determining the corresponding handshake round trip delay in the information flow record according to the information flow record, namely, the processing module can determine the WAN side delay and the LAN side delay of the terminal and the network equipment. For example, the processing module obtains a time difference between a time when the network device sends the second handshake message to the terminal and a time when the terminal sends the first handshake message to the network device, so as to obtain a WAN side time delay. And acquiring the time difference between the time when the terminal sends the third handshake message to the network equipment and the time when the network equipment sends the second handshake message to the terminal, and obtaining the time delay of the LAN side. If the WAN side time delay is larger than the set WAN side time delay threshold, determining that the WAN side equipment (network equipment and detection server) is abnormal. If the LAN side time delay is larger than the set LAN side time delay threshold value, determining that the LAN side equipment is abnormal. The processing module is further configured to dynamically adjust the delay threshold based on the plurality of information flow records and the WAN side delay and the LAN side delay in the plurality of information flow records, so as to more accurately determine the WAN side delay or the WAN side delay.

Optionally, the monitoring module of the router may also determine, based on the information flow record, a WAN side delay and a LAN side delay corresponding to the information flow record. After the monitoring module acquires the WAN side delay and the LAN side delay, the information can be sent to the processing module, and the processing module dynamically adjusts the delay threshold according to the WAN side delay and the LAN side delay in the information flow records.

And the management module of the router is used for discovering and managing the terminal. For example, the management module may obtain an on-line or off-line status of the terminal, and determine an on-line device and an off-line device within the monitoring range. The management module may also periodically probe the terminal to determine the actual state of the terminal. Alternatively, the management module may implement management of the terminal according to a dynamic host configuration protocol (dynamic host configuration protocol, DHCP) and an address resolution protocol (address resolution protocol, ARP).

Illustratively, the dynamic IP address is an automatically assigned address for the terminal. In the case that the router receives the DHCP request of the terminal 1 and needs to return an ACK message to the terminal 1, the module managing the DHCP standard in the router adds an information entry about the terminal 1 and allocates a dynamic internet protocol address (internet protocol address, IP address) to the terminal 1, determining that the terminal 1 is in an on-line state. Illustratively, the entry may be a release entry. A module for managing the DHCP standard in the router sends a message to a management module to inform the terminal 1 of being in an online state, wherein parameters carried by the sent message comprise a local area network address (media access control address, MAC address), a network port name and an IP address of the terminal 1; formats may be 6c:02:e0:66:23:59, eth0.3, 192.168.2.111.

The static IP address is a fixed IP address aiming at the terminal. After the router receives the ARP message of the terminal 2, analyzing the MAC address, the network port name and the IP address, if the IP address is determined to be in the LAN network segment and is not recorded by the management module, determining that the terminal 2 is static IP equipment, and determining that the terminal 2 is in an online state. A module for managing the DHCP standard in the router sends a message to a management module to inform the terminal 2 of being in an online state, wherein parameters carried by the sent message comprise a local area network address (media access control address, MAC address), a network port name and an IP address of the terminal 2; the format may be the same as the message format described above.

The management module may periodically perform ARP detection on the at least one terminal. The probing frequency may be, for example, once for 5 minutes. If the router does not receive the ARP response returned by the terminal 3, the terminal 3 is determined to be in the offline state. The module in the router that manages the DHCP standard sends a message to the management module informing the terminal 3 that it is in the off-line state. The parameters carried by the transmitted message comprise a local area network address (media access control address, MAC address), a network port name and an IP address of the terminal 3; the format may be the same as the message format described above.

In some embodiments, the information of the single terminal recorded by the management module may include the following table 1, for example:

TABLE 1

MAC address	Character strings, such as 11:22:33:44:55:66
		Network port name	Character strings, e.g. eth0.3, wl0, etc
IP address	Shaping, e.g. 192.168.2.111
		Detection result	Substructures

The management information of the single terminal comprises the MAC address, the network port name and the IP address of the terminal and the detection result corresponding to the terminal. The detection result comprises information such as ping detection state, time, three-way handshake detection result, 1-2-way handshake round trip delay (WAN side delay), 2-3-way handshake round trip delay (LAN side delay), wi-Fi signal strength, wi-Fi negotiation rate, ping gateway delay, ping wide area network delay, and ping standby network delay of the device.

Alternatively, the management module may define a parameter to indicate whether the terminal is in an on-line state or an off-line state. Illustratively, the parameters may be defined as bActive. After finishing the management of the terminal on-line and off-line, the management module can also send a request to the monitoring module, wherein the request is used for indicating the monitoring module to analyze the information flow of the terminal in the on-line state only. Alternatively, the request may carry information of the terminal in the online state, for example, a MAC address, an IP address, a device identifier, and the like of the terminal. And the monitoring module acquires and analyzes the information flow of the terminal in the online state according to the information of the terminal in the online state.

The router diagnosis module is used for sending test instructions to corresponding WAN side equipment and LAN side equipment when the processing module determines that at least one condition of WAN side time delay timeout and LAN side time delay timeout exists between the terminal and the network equipment, and determining equipment with network abnormality according to test responses returned by the WAN side equipment and the LAN side equipment. In an exemplary case, the diagnosis module may perform ping detection on the WAN side device when determining that the WAN side time delay is timeout, send a ping packet to the WAN side device, and determine whether the WAN side device is abnormal according to the time when the ping packet returned by the WAN side device is received. Illustratively, the diagnostic module may test devices such as LAN-side wired devices, LAN-side wireless devices, WAN-side devices (network devices), light cats, and the like.

In some embodiments, fig. 5 presents a schematic diagram of another router each module performing a network diagnostic method. The path denoted by 1 in fig. 5 indicates that when the terminal uploads the handshake message through Wi-Fi drive or internet access drive of the router, a monitoring module of the router monitors the handshake message, records the time of receiving the handshake message and the transmission direction of the handshake message, and forwards the handshake message to the corresponding network device. Correspondingly, when the network device sends out the handshake message through the network port drive of the router, the monitoring module of the router monitors the handshake message sent by the network device, records the time of receiving the handshake message and the transmission direction of the handshake message, and forwards the handshake message to the corresponding terminal. Optionally, the monitoring module may generate an information flow record including a time of sending a handshake message between the terminal and the network device, and a time of the network device responding to the handshake message.

The listening module may send a plurality of information flow records to the processing module. As shown in the path labeled 2 in fig. 5, the processing module determines, according to the plurality of information flow records, the WAN side delay and the LAN side delay of the terminal and the network device corresponding to each information flow record. If the WAN side time delay is larger than the set WAN side time delay threshold, determining that the WAN side equipment (network equipment) is abnormal. If the LAN side time delay is larger than the set LAN side time delay threshold value, determining that the LAN side equipment is abnormal.

After determining the abnormal point of the network, the processing module may generate network abnormal report information and report the network abnormal report information to the analysis server, such as the path labeled 3 in fig. 5. The processing module is further configured to dynamically adjust the delay threshold based on the plurality of information flow records and the WAN side delay and the LAN side delay in the plurality of information flow records, so as to more accurately determine the WAN side delay or the WAN side delay.

Optionally, the monitoring module may also determine handshake round trip delay of the terminal corresponding to each information flow record and the network device according to the information flow record. In case it is determined that a handshake round trip delay exists, the listening module may trigger the diagnostic module to test the corresponding device, as in the path marked 4 in fig. 5.

The diagnosis module can send test instructions to the corresponding WAN side equipment and LAN side equipment, and the equipment with network abnormality is determined according to test responses returned by the WAN side equipment and the LAN side equipment. Illustratively, as shown by the path labeled 5 in fig. 5, the diagnostic module may perform ping detection on the LAN side device in the case of determining that the LAN side delay is time-out, send a ping packet to the LAN side device, and determine whether the LAN side device is abnormal according to the time when the ping packet returned by the LAN side device is received. The diagnosis module may perform ping detection on WAN side equipment (network equipment) under the condition that the WAN side time delay is determined to be overtime, such as a path labeled 6 in fig. 5, send a ping packet to the WAN side equipment, and determine whether the WAN side equipment is abnormal according to the time when the ping packet returned by the WAN side equipment is received.

In some embodiments, after testing the WAN side device and the LAN side device, the diagnostic module generates network anomaly report information, and reports the network anomaly report information to the analysis server, such as the path labeled 7 in fig. 5.

In some embodiments, the diagnostic module may also generate a network anomaly prompt message, and issue the network anomaly prompt message to the terminal, such as the path labeled 8 in fig. 5. The network anomaly prompt information can include a reason for network slowness and a suggestion for improving an optimized network.

In some embodiments, the management module may perform probe management of the on-line and off-line of the terminal, such as the path labeled 9 in fig. 5; in addition, the management module may also obtain the three-way handshake detection result of the terminal and the network device through the monitoring module, such as a path labeled 10 in fig. 5.

Fig. 6 is a flow chart of a network diagnosis method, where fig. 6 relates to interactions among a management module, a diagnosis module, a listening module and a processing module of a router, and includes:

the management module of the router carries out online and offline management and state detection on the terminal; and the device management information is sent to a monitoring module, and the monitoring module only carries out handshake monitoring on the online terminal.

And the monitoring module of the router monitors the handshake of the online terminal to acquire handshake delay information of each terminal. The handshake delay information comprises WAN side delay and LAN side delay of the terminal. And the monitoring module sends the handshake delay information to the processing module.

After initializing a timing event, a processing module of the router judges whether a terminal has time delay overtime according to the received handshake time delay information and the acquired time delay threshold value, and returns time delay overtime information to a monitoring module. If the WAN side time delay is larger than the WAN side time delay threshold, the WAN side time delay is overtime, and the time delay overtime information comprises a WAN time delay overtime mark; if the time delay of the LAN side is overtime, the time delay overtime information comprises a time delay overtime mark of the LAN side. The device with the WAN side delay marker or the LAN side delay marker is a suspected abnormal device.

And the monitoring module reports the time delay overtime information to the diagnosis module.

The diagnosis module of the router tests suspected abnormal equipment involved in the communication process of the terminal based on the WAN side delay mark or the LAN side delay mark contained in the diagnosis module according to the received handshake delay information of each terminal, the diagnosis module can send a test instruction to the abnormal equipment, and judges whether the abnormal equipment is really abnormal in network according to test response returned by the abnormal equipment. Illustratively, the diagnosis module performs ping detection on the abnormality to obtain a ping detection result corresponding to the terminal. The ping detection result comprises information such as abnormal equipment, reasons for abnormality of the abnormal equipment and the like. Alternatively, the diagnostic module may report the ping detection result to a logging server or an analysis server.

The processing module of the router can also acquire the sampling information of the terminal at regular time. Optionally, the processing module may randomly acquire sampling information of the terminal at regular time and quantity, and report the acquired sampling information to the analysis server. For example, the processing module acquires sampling information of any one device in one day, and reports one piece of sampling information of the device to the analysis server. Therefore, the data processing amount of the analysis server can be reduced, and the calculation resources, transmission resources and storage space of the analysis server are saved.

Based on the network diagnosis method, the router can judge whether the reason for slow network access of the network access equipment is equipment on the LAN side or equipment on the WAN side based on the handshake round trip time delay between the terminal and the network equipment and the preliminary judgment; furthermore, by sending a test instruction to the suspected abnormal device and positioning to one device on the LAN side or the WAN side which causes slow network access of the network device according to the test response of the suspected abnormal device, the accurate positioning of the abnormal point in the slow network scene can be realized. And after determining the abnormal point, the router can also generate network abnormal report information and report the network abnormal report information to the analysis server so as to perform abnormal analysis and optimization of the abnormal point, thereby improving user experience.

In some embodiments, a router network diagnostic method provided herein may be adapted in internet protocol version4 (internet protocol version, IPv 4), internet protocol version6 (internet protocol version, IPv 6). The router network diagnosis method provided by the application comprises two parts, namely determining suspected abnormal equipment according to communication handshake round-trip delay between a terminal and network equipment and determining the abnormal equipment by carrying out network test on the suspected abnormal equipment, wherein the two parts are respectively described below.

In some embodiments, a method for determining a network anomaly device according to a handshake round trip delay and a handshake message transmission direction between a terminal and a network device is provided, and a router may perform statistics and analysis by using connection conditions of a LAN access device (terminal) and a cat WAN, which are strongly related to the router, as detection points, so as to infer an anomaly path in a data forwarding process. The terminal access network typically communicates via the transmission control protocol TCP. TCP is a reliable transmission protocol facing to connection, and can ensure that a bi-directional message is received and transmitted, and the network connectivity detection is carried out based on the characteristic of TCP in the embodiment, so that the detection result is reliable.

Before describing a method for determining network abnormal equipment according to the communication handshake round trip delay between a terminal and network equipment and the handshake message transmission direction, a simple description is given to TCP three-way handshake. Illustratively, fig. 7 shows a schematic diagram of a TCP three-way handshake procedure between a terminal (e.g., a terminal) and a network device (e.g., a server), and referring to fig. 7, the TCP three-way handshake procedure between the terminal and the server includes:

(1) The terminal sends a first handshake message to the server, wherein the handshake message comprises syn data packets: the terminal sets the flag bit SYN of the TCP handshake message as 1, randomly generates a sequence number value seq=J, stores the sequence number value in a sequence number (sequence number) field of the head of the TCP handshake message, and indicates the port of the server to be connected by the terminal to obtain a SYN data packet. And the terminal sends the syn data packet to the server. Optionally, after the terminal finishes sending the handshake message, the terminal enters a syn_send state and waits for confirmation of the server.

(2) The server sends a second handshake message to the terminal, wherein the handshake message comprises a synack data packet: after receiving the SYN data packet, the server analyzes the SYN data packet and checks whether the flag bit SYN in the SYN data packet is 1 and the sequence number value seq is J. When SYN is acquired to be 1 and seq=j, the server determines that the terminal requests to establish connection by the flag syn=1. In this case, the server sets both flag bits SYN and ACK of the TCP packet to 1, sets ack=j+1, and randomly generates a sequence number value seq=k, to obtain a synack packet. And the server sends the synack data packet to the terminal, waits for the terminal to confirm the connection request, and then enters a SYN_RCVD state.

(3) The terminal sends a third handshake message to the server, wherein the handshake message comprises an ack data packet: after receiving the synack data packet, the terminal analyzes the synack data packet, and checks whether the flag bit SYN in the synack data packet is 1, whether the ACK is 1, whether the sequence number seq is k, and whether the ACK is J+1. If SYN is 1, ACK is 1, sequence number seq is K, and ACK is J+1, the flag bit ACK is 1, and ACK is K+1, so that an ACK data packet is obtained. The terminal transmits the ack packet to the server.

(4) The server receives the ack data packet, analyzes the ack data packet, and checks whether the ack of the ack data packet is K+1 or not and whether the ack is 1 or not. If ACK is K+1 and ACK is 1, connection establishment is successful, and the terminal and the server enter an ESTABLISHED state to complete three-way handshake. At this time, data transmission between the terminal and the server may be started.

The TCP three-way handshake between the terminal and the server is realized through the above (1) - (4), and the communication connection between the terminal and the server is established.

In some embodiments, fig. 8 shows a schematic flow chart of a terminal implementing a TCP three-way handshake with a server through a router. As shown in fig. 8, the TCP three-way handshake flow between the terminal and the server through the router includes:

(1) The terminal sends a first handshake message to the router, wherein the handshake message comprises syn data packets: the terminal sets the flag bit SYN of the TCP handshake message as 1, randomly generates a sequence number value seq=J, stores the sequence number value in the sequence number field of the head of the TCP handshake message, and indicates the port of the server to be connected by the terminal to obtain a SYN data packet. The terminal sends syn packets to the router. Optionally, after the terminal finishes sending the SYN data packet, the terminal enters a syn_send state and waits for confirmation of the server.

(2) The router realizes the forwarding of the first handshake message: and the router receives the syn data packet, performs address conversion, and forwards the syn data packet to a corresponding server according to the address of the destination device.

(3) The server sends a second handshake message to the terminal, wherein the handshake message comprises a synack data packet: after receiving the SYN data packet, the server analyzes the SYN data packet and checks whether the flag bit SYN in the SYN data packet is 1 and the sequence number value seq is J. When SYN is determined to be 1 and seq=j, the server determines from the flag syn=1 that the terminal requests to establish a connection. In this case, the server sets both flag bits SYN and ACK of the TCP packet to 1, sets ack=j+1, and randomly generates a sequence number value seq=k, to obtain a synack packet. And the server sends the synack data packet to the router, waits for the terminal to confirm the connection request, and then enters a SYN_RCVD state.

(4) The router realizes the forwarding of the second handshake message: and the router receives the synack data packet, performs address conversion, and forwards the synack data packet to the corresponding terminal according to the address of the source equipment.

(5) The terminal sends a third handshake message to the server, wherein the handshake message comprises an ack data packet: after receiving the synack data packet, the terminal analyzes the synack data packet, and checks whether the flag bit SYN in the synack data packet is 1, whether the ACK is 1, whether the sequence number seq is k, and whether the ACK is J+1. If SYN is 1, ACK is 1, sequence number seq is K, and ACK is J+1, the flag bit ACK is 1, and ACK is K+1, so that an ACK data packet is obtained. The terminal sends the ack packet to the router.

(6) The router realizes the forwarding of the third handshake message: the router receives the ack data packet, performs address conversion, and forwards the ack data packet to a corresponding server according to the destination device address.

(7) The server receives the ack data packet, analyzes the ack data packet, and checks whether the ack of the ack data packet is K+1 or not and whether the ack is 1 or not. If ACK is K+1 and ACK is 1, connection establishment is successful, and the terminal and the server enter an ESTABLISHED state to complete three-way handshake. At this time, the terminal may transmit data with the server through the router.

The TCP three-way handshake between the terminal and the server through the router is realized through the (1) - (7), and communication connection among the terminal, the router and the server is established.

In the process that the terminal performs TCP three-way handshake with the server through the router, the router can monitor TCP three-way handshake messages by setting a monitoring point through the monitoring module. Optionally, the monitoring module may monitor the TCP three-way handshake message by using an iptables call chain of a kernel netfilter framework of the router. The iptables are management tools of netfilter, and TCP three-way handshake messages can be realized through the iptables call chain. For example, netfilter may place a plurality of listening points (hooks) at several locations of the packet processing flow of the router, and define a corresponding callback function at each listening point for data processing, where the callback function of each chain may be determined according to the information analysis flow in the kernel standard structure.

FIG. 9 shows a schematic diagram of an iptables call chain. Referring to fig. 9, the rule of the iptables call chain is that when a packet enters the network card of the router, first enters the pre-routing (forwarding) chain, and the core of the router determines whether to need to be forwarded according to the IP of the destination device of the packet. If the packet is in the native state, then an INPUT (INPUT) chain is entered, and after the packet arrives at the INPUT chain, any process in the native state will receive the packet. The program running on the machine can send data packets, and the data packets can be OUTPUT through the network card of the router through the OUTPUT (OUTPUT) chain after reaching the route (POSTROUTING) chain. If the packet is to be forwarded, and the core of the router allows forwarding, the packet may go through a forwarding (forwarding) chain, reach a postcount chain, and be output through the network card.

As can be seen from fig. 8 and fig. 9, after the router receives the syn packet sent by the terminal, it determines that the syn packet is a packet to be forwarded based on the IP of the destination device, and the syn packet is output through the network card based on the (postcount) chain. Based on this, referring to fig. 9, a listening point 1 (listening point of reference number 1 in fig. 9) is set in the postcount chain, and the listening module listens to the syn packet sent by the terminal and records the first time when the router receives the syn packet. The router receives the synack packet, and a listening point 2 (a listening point denoted by reference numeral 2 in fig. 9) may be set in the PREROUTING chain, where the listening module listens for the synack packet sent by the server and records a second time when the router receives the synack packet. The terminal sends an ack packet corresponding to the listening point 1, sets a listening point 3 (a listening point of reference number 3 in fig. 9) in the postcount chain, and the listening module listens to the syn packet sent by the terminal and records the third time when the router receives the packet. In some embodiments, optionally, the network of the WAN side device is considered to be abnormal for the one of the flows when the second time that the router receives the synack packet exceeds a set time threshold. When the third time of the router receiving the ack packet exceeds a set time threshold, the network of the LAN side equipment of the information flow is considered to be abnormal.

In some embodiments, fig. 10 shows a flowchart of the iptables call chain of the netfilter framework of the router core and the interception module intercepting the TCP three-way handshake. In fig. 10, a terminal starts surfing the internet, and sends a first handshake message to a server through a router, wherein the first handshake message carries a syn data packet. The Forwarding (FORWARD) chain in the iptables call chain monitors syn data packets and simultaneously notifies a monitoring module, and the monitoring module newly adds data such as sequence information, syn time and the like of the information flow of the terminal. The post-route (postroute) chain in the iptables call chain monitors syn data packets, notifies the monitoring module, and the monitoring module updates the syn time of the information flow of the terminal. The pre-route (pre) chain in the iptables call chain listens for the synack data packet, and at the same time informs the listening module, which updates the synack time of the information flow of the terminal. The monitoring module can also calculate the three-way handshake WAN side time delay of the terminal information flow based on the synck time and the syn time, and the WAN side time delay is syn < - > synck (RTT 1). The POSTROUTING chain monitors the synack data packet and simultaneously informs a monitoring module, and the monitoring module updates the synack time and sequence information of the information flow of the terminal. The PRROUTING chain listens for the ack packet and simultaneously informs the listening module, and the listening module calculates the three-way handshake LAN side delay of the terminal information flow based on the synack time and the ack time, wherein the LAN side delay is synack < - > ack (RTT 2).

In some embodiments, if RTT1 is greater than the WAN side delay threshold, determining that the WAN side delay times out; if RTT2 is larger than the LAN side delay threshold, determining that the LAN side delay is overtime, and monitoring and judging the delay of the three-way handshake between the terminal and the server are realized through the iptables calling chain and the monitoring module.

In other embodiments, fig. 11 shows a schematic diagram of setting a listening point by a router during a three-way handshake between a terminal and a server.

Referring to fig. 11, after the router receives the syn packet transmitted by the terminal, the listening point No. 4 is set. And the No. 4 monitoring point is used for judging whether a certain information flow has the same network segment of the source IP address and br0 and has different network segments of the destination IP address and br 0. Wherein, the source IP refers to the terminal IP address, and the destination IP address refers to the IP address of the network equipment; br0 refers to the bridge interface address. If the source IP address and br0 are the same segment and the destination IP address and br0 are different segments, the description is a TCP connection sent by the terminal to the network device, in which case the current information flow can be used as the flow to be monitored by the router. Alternatively, the router may add the information flow to an analysis linked list. The linked list firstly takes the equipment information corresponding to the MAC address as the node, and a sub-linked list composed of a plurality of information flows of the equipment exists under each node.

Alternatively, in some embodiments, instead of setting the listening point at point 4 shown in fig. 11, the router may trigger the operation of determining whether the source IP address and br0 of the information flow are the same network segment, and whether the destination IP address and br0 are different network segments after receiving the syn packet. It should be noted that, setting the listening point No. 4 is to determine the source IP address and br0, and the destination IP address and br0 before address conversion in the handshake message sent by the terminal before the router performs address conversion, that is, before the router converts the address to forward the handshake message to the network device.

When the router forwards the syn data packet sent by the terminal to the network equipment, a No. 5 monitoring point is set, and the No. 5 monitoring point is used for recording a time point t1 of the information flow TCP primary handshake WAN side outgoing.

When the router receives a synack data packet sent by the server, setting a No. 6 monitoring point, wherein the No. 6 monitoring point is used for recording a time point t2 when the information flow TCP secondary handshake reaches the WAN side of the router.

When the router forwards the synack data packet sent by the server to the terminal, a No. 7 monitoring point is set, and the No. 7 monitoring point is used for recording a time point t3 when the information flow TCP secondary handshake comes out from the LAN side.

When the router receives a syn data packet sent by the terminal, a No. 8 monitoring point is set, and the No. 8 monitoring point is used for recording a time point t4 when the TCP three-way handshake of the information flow reaches the router LAN side.

In this embodiment, the time difference between t2 and t1 is WAN side delay; the time difference between t4 and t3 is the LAN side delay. If the WAN side time delay is larger than a preset time delay threshold, determining that the WAN side time delay is overtime, and marking that the Internet surfing is slow is triggered by WAN side equipment; if the time delay of the LAN side is larger than the preset time delay threshold, determining that the time delay of the LAN side is overtime, and marking that the Internet surfing is slow is triggered by the LAN side equipment.

A method for determining network anomaly devices according to communication handshake round trip delay between a terminal and network devices and handshake message transmission directions is described by combining a monitoring module and a processing module of a router. Fig. 12 shows an interaction diagram among a terminal, a listening module of a router, a server, and a processing module of the router, including:

s101, starting a router, initializing a processing module, and periodically polling the currently recorded equipment delay information by the processing module.

In some embodiments, after the router is powered on, the processing module is started, and the processing module initializes the module state. After initialization, the processing module performs timing polling on the monitoring module to acquire all information flows recorded by the monitoring module. The timing poll may be, for example, a poll every 10 seconds.

S102, the terminal sends syn data packets to the router.

The terminal sends a first handshake message in the TCP handshake process to the router, wherein the first handshake message carries syn data packets.

S103, a monitoring module of the router records a first time point of the syn data packet sent out through the WAN side of the router.

In some embodiments, after receiving the syn packet, the server needs to send the syn packet to the corresponding server through the WAN side network port according to the port of the corresponding server in the syn packet. When the server sends out the syn data packet through the WAN side network port, the monitoring module records the current sending time point and is used as a first time point t1 of the TCP primary handshake WAN side network port sending out the syn data packet in the current information flow.

S104, the monitoring module of the router forwards the syn data packet to the server.

In some embodiments, the listening module of the router forwards the syn packet to the server according to the port of the corresponding server in the syn packet.

S105, a monitoring module of the router receives a synack data packet sent by the server.

After receiving the syn data packet, the server analyzes the syn data packet and generates a synock data packet according to the data in the syn data packet. And the server sends a second handshake message carrying the synack data packet to the router.

And a monitoring module of the router receives the synack data packet sent by the server.

S106, a monitoring module of the router records a second time point when the synack data packet arrives at the WAN side of the router.

In some embodiments, the listening module of the router receives the synack packet sent by the server. The monitoring module records a second time point when the synack data packet arrives at the router WAN side, namely, the monitoring module records a second time point t2 when the TCP secondary handshake synack data packet arrives at the router WAN side in the current information flow.

Optionally, the first time point t1 is a time point when the router WAN side sends out data, the second time point t2 is a time point when the router WAN side receives data, and the monitoring module may acquire a time difference (t 2-t 1) between the second time point and the first time point as a WAN side delay difference. Illustratively, if the WAN side delay is greater than the WAN side delay threshold, determining that the WAN side delay times out, and that the network on the WAN side has network anomalies.

And S107, a monitoring module of the router records a third time point of sending the synack data packet to the terminal through the LAN.

In some embodiments, the listening module records a third point in time t3 at which the synack packet is sent to the terminal over the LAN.

S108, a monitoring module of the router sends a synack data packet to the terminal through the LAN.

In some embodiments, the listening module of the router may forward the synack packet to the corresponding terminal according to the source device address in the synack packet.

S109, a monitoring module of the router receives an ack data packet sent by the terminal.

In some embodiments, after receiving the synack packet, the terminal parses the synack packet and generates an ack packet according to data in the synack packet. And the terminal sends the third handshake message carrying the ack data packet to the router.

The monitoring module of the router captures the ack data packet sent by the terminal.

S110, a monitoring module of the router records a fourth time point when the ack data packet arrives at the router LAN side.

In some embodiments, the router receives an ack packet sent by the terminal. The monitoring module records a fourth time point when the ack data packet arrives at the router LAN side, that is, the monitoring module records a fourth time point t4 when the TCP three-way handshake ack data packet arrives at the router LAN side in the current information flow.

Optionally, the third time point t3 is a time point when the router LAN side sends out data, the fourth time point t4 is a time point when the router LAN side receives data, and the listening module may acquire a time difference (t 4-t 3) between the fourth time point and the third time point as the LAN side delay. Illustratively, if the LAN side delay is greater than the LAN side delay threshold, determining that the LAN side delay times out, the LAN side network has a network anomaly.

S111, a monitoring module of the router forwards the ack data packet to the server.

In some embodiments, the listening module of the router implements forwarding of the third handshake message: and capturing the ack data packet by a monitoring module of the router, and forwarding the ack data packet to a corresponding server according to the port of the server.

In some embodiments, the terminal a interacts with the server B through the router to form an information flow between the terminal a and the server B, where the information flow includes time points corresponding to each data packet in the three-way handshake process between the terminal a and the server B recorded by the monitoring module, for example, a first time point t1 of S102, a second time point t2 of S104, a third time point t3 of S105, and a fourth time point t4 of S108; the information stream also includes information of the terminal A and information of the server B as the identification of the current information stream.

Optionally, after the listening module obtains the first time point t1 and the second time point t2, a time difference t2-t1 between the second time point and the first time point may be obtained as the WAN side delay. After the third time point t3 and the fourth time point t4 are acquired, a time difference t4-t3 between the fourth time point and the third time point is acquired as the LAN side delay. The WAN side delay and the LAN side delay may also be recorded in the information streams of the terminal a and the server B.

In some embodiments, the terminal includes a plurality of terminals, and the monitoring module monitors handshake and communication processes between each terminal and its corresponding server, so as to generate a plurality of information flows corresponding to each terminal. Alternatively, the listening module may store multiple information flows in the memory of the router, or may store multiple information flows in the memory space of the listening module.

And S112, the processing module judges the time delay overtime of the acquired information streams according to a time delay judging algorithm.

The process of determining the processing module may be illustrated with reference to fig. 13, and fig. 13 shows a flowchart of a processing module executing a time-delay timeout determination algorithm, including:

s1121, the processing module acquires a WAN side delay threshold and a LAN side delay threshold.

In some embodiments, the processing module may obtain the WAN side latency threshold and the LAN side latency threshold from a memory of the router, or may obtain the WAN side latency threshold and the LAN side latency threshold from a shared memory of the router. The memory or the shared memory may store a default value Q1 of the WAN side delay threshold and a default value Q2 of the LAN side delay threshold. After the judgment module performs the dynamic adjustment of the threshold value, the WAN side time delay threshold value after the dynamic adjustment and the LAN side time delay threshold value after the dynamic adjustment can be stored in the memory or the shared memory.

Alternatively, if the processing module acquires the WAN side delay threshold and the LAN side delay threshold for the first time after the start-up, the processing module acquires the default value Q1 of the WAN side delay threshold and the default value Q2 of the LAN side delay threshold.

Optionally, in some embodiments, the processing module may set a timing to make a delay determination to reduce consumption of the processing module. Illustratively, when the processing module determines that the logic for timing the delay determination expires, the processing module triggers execution of an operation for performing the delay determination based on the recorded delay information.

S1122, the processing module traverses all the information streams acquired currently and judges whether all the information streams are traversed.

In some embodiments, the processing module may traverse all of the information flows acquired from the listening module, traversing the acquired information flows to determine whether there is a WAN-side delay timeout or a LAN-side delay timeout. If the traversal is completed, that is, the delay determination is completed for all the current information flows, S1115 and S1116 are executed. If the traversal is not completed, that is, the currently acquired information stream has no delay judgment, S1113 is executed.

S1123, the processing module judges whether the information flow has time-out of the WAN side time delay or the LAN side time delay.

In some embodiments, the processing module makes the determination with sliding window logic, which may be 5 window size, for example. Illustratively, the processing module traverses every 5 information streams to determine whether there are at least 4 information streams for which a WAN-side delay or a LAN-side delay has occurred.

Optionally, in conjunction with fig. 12, if the information stream includes a first time point, a second time point, a third time point, and a fourth time point, the processing module needs to calculate a first time difference (WAN side delay) between the second time point and the first time point. Comparing the first time difference with a WAN side time delay threshold, and if the first time difference is larger than the WAN side time delay threshold, determining that the information flow has WAN side time delay overtime. The processing module calculates a second time difference (LAN-side delay) between the fourth time point and the third time point. And comparing the second time difference with the LAN side time delay threshold value, and if the second time difference is larger than the LAN side time delay threshold value, determining that the information flow has the LAN side time delay overtime.

S1124, if the WAN side time delay time-out exists, the processing module marks the WAN side time delay time-out; if the time-out of the LAN side time delay exists, the processing module marks the time-out of the LAN side time delay.

In some embodiments, if there are 4 information streams out of every 5 information streams that are time-out, the processing module time-out marks the 5 information streams. If the 4 information flows are all LAN side time delays larger than the LAN side time delay threshold value, marking that the LAN side time delays are overtime; if the 4 information flows are all WAN side delays larger than WAN side delays, marking WAN side delays to be overtime. If the 4 information flows comprise both the information flow with the time-out of the WAN side time delay and the information flow with the time-out of the LAN side time delay, marking the time-out of the WAN side time delay and the time-out of the LAN side time delay. After the time delay timeout is marked, the processing module continues to judge other flows.

If the time delay time-out exists in the 4 information streams which are not satisfied in every 5 information streams, the processing module continues traversing the rest information streams.

S1125, the processing module acquires time delay information of one information stream and reports the time delay information to the analysis server.

In some embodiments, if the processing module determines that the currently recorded information stream is traversed, randomly acquiring one information stream from all the information streams, and reporting delay information of the information stream to the analysis server. The delay information of the information flow refers to the WAN side delay value and the LAN side delay value of the information flow.

In some embodiments, the analysis server receives delay information of the information stream uploaded by the processing module of the router. Alternatively, the analysis server may determine the dynamic delay threshold based on delay values in the plurality of information streams. For example, the time delay values in a plurality of information streams are ordered, and a median value is taken as a dynamic time delay threshold; or taking the average value of the time delay values as a dynamic time delay threshold; or taking the appointed value in the time delay values as a dynamic time delay threshold value. Alternatively, the specified value may be the nth value. For example, the analysis server calculates the dynamic latency threshold using the 90% principle. Illustratively, the analysis server sorts all acquired information flows according to the delay values of the information flows, alternatively, the acquired information flows may be sorted from small to large according to the delay values of the information flows, and the delay value reaching 90% is determined as the dynamic delay threshold. For example, the total number of the information flows obtained by the analysis server is 100, and according to the principle of 90%, the time delay value of the 90 th information flow from small to large is the dynamic time delay threshold. For example, from 100 information streams, the delay value of the 90 th information stream is W, and then W is determined as the dynamic delay threshold.

The LAN side delay threshold and the WAN side delay threshold may be both determined according to the 90% principle. Illustratively, all information flows are ordered from small to large according to the LAN side delay value of each information flow, and the LAN side delay value reaching 90% is determined as the LAN side dynamic delay threshold. For example, the total number of information flows is 100, and according to the principle of 90%, the LAN side delay value of the 90 th information flow with the delay value from small to large is the LAN side dynamic delay threshold. Illustratively, all the information flows are sorted from small to large according to the WAN side delay value of each information flow, and the WAN side delay value reaching 90% is determined as the WAN side dynamic delay threshold. For example, the total number of the information flows is 100, and according to the principle of 90%, the WAN side delay value of the 90 th information flow from the small delay value to the large delay value is the WAN side dynamic delay threshold.

After acquiring the LAN side dynamic delay threshold and the WAN side dynamic delay threshold, the analysis server may send the LAN side dynamic delay threshold and the WAN side dynamic delay threshold to the processing module of the router, so that the processing module executes S1111 based on the LAN side dynamic delay threshold and the WAN side dynamic delay threshold.

S1126, the processing module judges whether time delay timeout marks exist in all traversed information streams, and if at least one time delay timeout mark exists, S1117 is executed; if any one of the time-delay timeout flags does not exist, S1118 is performed.

S1127, the processing module reports the time delay information of the information stream with the time delay overtime mark obtained by current traversal to the analysis server, waits for the arrival of the next time delay judging period, and returns to execute S1111.

The delay information comprises delay values, delay overtime types and the like of each information flow. For example, the delay value of the information flow 1 is Q1, and the delay timeout type is LAN side delay timeout.

S1128, the processing module waits until the next delay judgment period arrives, and returns to execute S1111.

In the method, a monitoring module of the router calculates the time difference by sending out the data packet from the WAN side and recording the corresponding time point when receiving the data packet from the WAN side, thereby obtaining the time delay from the WAN side. And the monitoring module records corresponding time points when the data packet is transmitted through the LAN side and received through the LAN side, calculates the time difference and obtains the time delay of the LAN side. The WAN side time delay and the LAN side time delay of each information flow of the monitoring module are stored in a memory so as to be provided for the processing module to carry out time delay judgment. Through the steps S1111-S1118, a processing module of the router can obtain a LAN side dynamic time delay threshold and a WAN side dynamic time delay threshold, and can judge the time delay timeout of the information flow obtained from the monitoring module based on the LAN side dynamic time delay threshold and the WAN side dynamic time delay threshold, and when the information flow has the WAN side time delay timeout, the corresponding equipment in the information flow is determined to have WAN side network abnormality; and under the condition that the time delay of the LAN side of the information flow is overtime, determining that the corresponding equipment in the information flow has network abnormality of the LAN side. Therefore, the effect that the network is triggered slowly by WAN side equipment or LAN side equipment due to positioning under the router internet surfing environment is achieved, positioning of network abnormal equipment is achieved, and user experience is optimized.

In some embodiments, the method by which the listening module of the router determines WAN side latency and LAN side latency is different from the method provided in fig. 12. Fig. 14 provides another method for determining a network anomaly device according to a handshake round trip delay and a handshake message transmission direction between a terminal (terminal) and a network device (server), which includes:

s201, starting a router, initializing a processing module, and periodically polling the currently recorded equipment delay information.

S202, the terminal sends syn data packets to the router.

S203, a monitoring module of the router records a fifth time point of receiving the syn data packet.

In some embodiments, after capturing the syn packet, the listening module records a fifth point in time t5 when the syn packet is received.

S204, the monitoring module of the router forwards the syn data packet to the server.

In some embodiments, the router forwards the syn packet to the corresponding server according to the port of the corresponding server in the syn packet.

S205, a monitoring module of the router captures a synack data packet sent by the server.

In some embodiments, after receiving the syn packet, the server parses the syn packet to generate a synack packet according to the data in the syn packet. And the server sends a second handshake message carrying the synack data packet to the router. The monitoring module of the router captures the server and sends the synac data packet to the router based on the syn data packet.

S206, the monitoring module of the router records a sixth time point when the synack data packet is received.

In some embodiments, the listening module captures a synack packet, and records a sixth time point t6 when the synack packet is received.

In some embodiments, the time difference (t 6-t 5) between the sixth time t6 when the synack packet is received and the fifth time t5 when the syn packet is received is WAN side latency. If the WAN side delay is greater than the preset WAN delay threshold, it is determined that the WAN side delay is overtime and the network on the WAN side is abnormal.

S207, a monitoring module of the router sends a synack data packet to the terminal.

S208, the monitoring module of the router captures an ack data packet sent by the terminal.

S209, a monitoring module of the router records a seventh time point when the ack data packet is received.

In some embodiments, the listening module of the router records a seventh point in time t7 when the ack packet is received when the ack packet is captured.

In some embodiments, the time difference (t 7-t 6) between the seventh time point t7 when the ack packet is received and the sixth time point t6 when the synack packet is received is a LAN side delay. Illustratively, if the LAN side delay is greater than the LAN side delay threshold, determining that the LAN side delay times out, the LAN side network has a network anomaly.

S210, a monitoring module of the router forwards the ack data packet to the server.

In some embodiments, the terminal a interacts with the server B through the router to form an information flow between the terminal a and the server B, where the information flow includes each time point corresponding to each data packet in the three-way handshake process between the terminal a and the server B recorded by the monitoring module, for example, a fifth time point t5 of S203, a sixth time point t6 of S206, and a seventh time point t7 of S209; the information stream also includes information of the terminal A and information of the server B as the identification of the current information stream.

Optionally, after the listening module obtains the fifth time point t5 and the sixth time point t6, a time difference (t 6-t 5) between the sixth time point t6 and the fifth time point t5 may be obtained as the WAN side delay. After the sixth time point t6 and the seventh time point t7 are acquired, a time difference (t 7-t 6) between the seventh time point t7 and the sixth time point t6 is acquired as the LAN-side delay. The WAN side delay and the LAN side delay may also be recorded in the information streams of the terminal a and the server B.

S211, the processing module judges the time delay of the acquired information streams according to the time delay judging algorithm.

In some embodiments, the method for performing delay judgment on the acquired multiple information streams by the processing module according to the delay judgment algorithm may refer to the methods provided in S111 and S1111-S1118, which are not described in detail in this embodiment.

In some embodiments, the monitoring module of the router may report the recorded information flows to the analysis server, and the processing module of the router may report the delay judgment result of each information flow to the analysis server. Optionally, the structure body reported to the analysis server by the monitoring module and the processing module of the router may include the contents shown in the following table, including the MAC address of the device corresponding to the information flow, the three-way handshake delay judgment result and the handshake round trip delay. Wherein each parameter is:

TABLE 2

Optionally, the monitoring module and the processing module may form a structure array from handshake delay information of devices corresponding to the plurality of information flows, where the structure array is also a handshake delay detection result of each device. Reporting the result to an analysis server; meanwhile, the monitoring module can report the structure body array to the diagnosis module, and the diagnosis module triggers the ping detection operation after receiving the structure body array. The information structure of the present embodiment is not limited.

In the method, when capturing a handshake message, a monitoring module of the router records a time point of a responding data packet, and determines a WAN side delay and a LAN side delay according to a receiving time point of an adjacent data packet. The monitoring module stores the WAN side time delay and the LAN side time delay of each information flow into a memory so as to provide the processing module with time delay judgment. The processing module of the router can acquire a LAN side dynamic time delay threshold value and a WAN side dynamic time delay threshold value, and can judge the time delay timeout of the information flow acquired from the monitoring module based on the LAN side dynamic time delay threshold value and the WAN side dynamic time delay threshold value, and under the condition that the information flow has the WAN side time delay timeout, the corresponding equipment in the information flow is determined to have WAN side network abnormality; and under the condition that the time delay of the LAN side of the information flow is overtime, determining that the corresponding equipment in the information flow has network abnormality of the LAN side. Therefore, the effect that the network is triggered slowly by WAN side equipment or LAN side equipment due to positioning under the router internet surfing environment is achieved, positioning of network abnormal equipment is achieved, and user experience is optimized.

In some embodiments, after determining that a suspected abnormal device with a handshake delay timeout exists according to the method, the router may send a test instruction to the suspected abnormal device, and determine whether the suspected abnormal device is network abnormal according to a test response of the suspected abnormal device. Illustratively, the router may send a ping instruction to the suspected abnormal device, and determine whether the network is abnormal according to a ping packet returned by the suspected abnormal device. And realizing the secondary confirmation of the suspected abnormal equipment.

ping is a common command line tool for diagnosing network problems, and is used for determining whether a local device can successfully exchange (send and receive) data packets with another device, and then according to the returned information, whether parameters are set correctly, whether the operation is normal, whether the network is smooth, and the like can be deduced. The ping command may do the following:

the connection to the one or more remote computers is verified by sending control message protocol packets to the destination device and listening for reply packets. Wherein each transmitted data packet waits for a preset number of seconds at most.

The diagnostic module of the router may record the number of packets that have been transmitted and received, as well as time consuming statistics. The content is as follows:

Example 1 is the time consuming result in case of ping network connectivity:

/$ping192.168.2.111

ping192.168.2.111(192.168.2.111):56databytes

64bytesfrom192.168.2.111:seq＝0ttl＝128time＝0.703ms

64bytesfrom192.168.2.111:seq＝1ttl＝128time＝0.482ms

64bytesfrom192.168.2.111:seq＝2ttl＝128time＝0.660ms

---192.168.2.111pingstatistics---

3packetstransmitted,3packetsreceived,0％packetloss

round-tripmin/avg/max＝0.482/0.615/0.703ms

the ping result is that 192.168.2.111 is being ping with 56 bytes of data. Receiving the data of 64 bytes replied by 192.168.2.111, wherein the sequence number seq is 0, the time-to-live (ttl) is 128, and the time is 0.703ms; receiving the data of 64 bytes replied by 192.168.2.111, wherein the sequence number seq is 1, the time-to-live (ttl) is 128, and the time is 0.482ms; 64 bytes of data are received 192.168.2.111, where the sequence number seq is 3, the time-to-live (ttl) is 128, and the time is 0.660ms. 3 data packets are sent, 3 data packets are received, and the packet loss rate is 0%. The minimum value, the average value and the maximum value of the three ping detection time result are respectively 0.482ms, 0.615ms and 0.703ms.

Example 2 is a time consuming result in case of ping network failure:

/$ping192.168.2.2

ping192.168.2.2(192.168.2.2):56databytes

Requesttimedout

---192.168.2.2pingstatistics---

5 packets transmitted,0 packets received,100％packet loss

the ping result is that ping 192.168.2.2 is having 56 bytes of data. The request times out four times. 5 data packets are sent, 0 data packets are received, and the packet loss rate is 100%.

According to the information recorded by the diagnosis module, the network of the destination device of the ping can be determined to be in a connected or disconnected state, so that whether the destination device is an abnormal device or not can be determined.

Fig. 15 shows a schematic device interaction diagram of a router sending a ping packet to surrounding devices for outlier confirmation. Fig. 14 includes routers, terminals (tablet, cell phone, computer), optical cats, and wide area network devices (network devices, probe servers).

The path labeled 1 in fig. 15 refers to the diagnostic module of the router pinging the cat. Since the address of a general optical modem is the next hop address of the router, the diagnostic module of the router pings the next hop address to perform the next hop path detection, and can determine whether the optical modem is abnormal or whether the WAN of the router itself is abnormal. For example, the diagnostic module pings the light cat (next hop address) without receiving the data packet replied to the light cat, i.e. pinging is not done. At this point, the diagnostic module of the router may examine the parameters involved in the router establishing a connection with the cat to determine whether the router's parameters are problematic or the cat is problematic.

The path labeled 2 in fig. 15 refers to the diagnostic module of the router pinging the wide area network device. Wide area network devices such as network devices, operator core networks, switches, public network servers, and the like. The diagnostic module of the router may ping the public network server if a packet returned by the wan device is not received, i.e., ping is not performed. At this point, the diagnostic module of the router may check whether the router WAN side parameters are normal. Meanwhile, the router diagnosis module can also conduct fault removal according to ping results of other devices. For example, if the ping light cat is normal and the ping public network server is abnormal, it can be determined that there is a problem in the wide area network devices such as the server and the operator. Optionally, in this embodiment, a preset public network probe server is provided, the probe server is a network normal device, and the diagnostic module of the router may determine whether the router WAN is normal through ping the probe server.

The path labeled 3 in fig. 15 refers to the diagnostic module of the router pinging the wired internet device in the lan. If the data packet replied by the wired internet surfing equipment is not received, namely, the ping is not enabled, a diagnosis module of the router is required to check parameters such as network negotiation rate and the like, and the fault reason is determined.

The path labeled 4 in fig. 15 refers to the wireless internet device in the lan being pinged by the diagnostic module of the router. If the data packet replied by the wireless internet surfing equipment is not received, namely, ping is not conducted, a diagnosis module of the router is required to check parameters such as Wi-Fi channels, received signal strength indication (received signal strength indication, RSSI), negotiation bandwidth and the like, and the fault reason is determined.

In some embodiments, the ping result of the single terminal recorded by the diagnostic module may include the contents shown in the following table, and the three-way handshake between the terminal and the network device through the TCP protocol is exemplified as follows:

TABLE 3 Table 3

In some embodiments, the monitoring module may report the structural information of the information flow of the terminal to the diagnostic module when monitoring the LAN side handshake round trip delay and the WAN side handshake round trip delay of the terminal, where the structural information includes the LAN side handshake round trip delay and the WAN side handshake round trip delay of the terminal. And under the condition that the diagnosis module determines that the LAN side handshake round trip time delay is overtime based on the structural information of the terminal, the diagnosis module sends a test instruction to the terminal. The diagnostic module sends a ping instruction to the terminal, and if a response to the ping instruction is not received within a certain period of time, the diagnostic module determines that the terminal is not ping. If a response to the ping instruction is received within a certain time period, the diagnosis module obtains the response time period from sending the ping instruction to receiving the response, and determines whether the ping response of the terminal is overtime. The diagnosis module can send a test instruction to the WAN side equipment under the condition that the diagnosis module determines that the WAN side handshake round trip delay is overtime based on the structural information of the terminal. For example, the diagnostic module sends a ping instruction to WAN side devices such as network devices, and if a response to the ping instruction is not received within a certain period of time, it is determined that the network devices are not ping. If a response to the ping instruction is received within a certain time period, the diagnosis module obtains the response time period from sending the ping instruction to receiving the response, and determines whether the ping response of the network equipment is overtime.

In this embodiment, the monitoring module monitors handshake interaction information flow between each terminal and the network device establishing TCP connection, generates structured information, and reports the structured information to the diagnostic module. And the diagnosis module is used for carrying out test diagnosis on the WAN side equipment and the LAN side equipment based on the structural information corresponding to each terminal. The method can realize timely and accurate test on each terminal, thereby obtaining the network state test result corresponding to each terminal.

Optionally, if the number of terminals of the router is multiple, the diagnosing module may test and diagnose the structural information of each terminal in time, which increases the cost of the diagnosing module. In one possible implementation manner, the monitoring module may acquire information flows of each terminal, and generate structured information corresponding to a plurality of information flows after the information flows are accumulated to reach a preset number. The structured information includes the corresponding point handshake round trip delay of the information flow of the plurality of terminals. The diagnosis module can carry out information statistics and information screening on the structured information comprising a plurality of terminal information streams, so as to carry out targeted ping diagnosis.

Illustratively, in some embodiments, FIG. 16 presents a flow chart of a method for ping detection by a diagnostic module. Referring to fig. 16, it includes:

S301, receiving the structural information reported by the monitoring module.

In some embodiments, after the handshake delay detection result between the monitoring terminal and the destination device is completed, the monitoring module of the kernel generates corresponding structured information after the handshake delay detection result is obtained. The monitoring module reports the structured information to the diagnosis module of the application layer. The diagnostic module triggers the initiation of ping detection after receiving the structured information.

S302, judging whether the WAN dialing is normal.

In some embodiments, the diagnostic module may obtain WAN dial-up status parameters of the router. And determining whether the WAN dialing of the router is normal according to the WAN dialing state parameters. For example, when the WAN dial-up status parameter is 1, it indicates that the device is in a network state, and the surrounding devices may be detected by ping, and S303 is executed. When the WAN dialing state parameter is 0, the dialing state parameter indicates that the dialing state parameter is not dialed, and the information received by the diagnosis module is the information before the dialing is disconnected. In the case of non-dialing (i.e. not networked), the ping must be unfeasible, in which case no processing is done directly. I.e. no ping detection is done.

S303, judging whether the ping process is idle.

In some embodiments, the ping detection needs to perform the ping detection on each device in the structured information according to the handshake delay detection result, and the timeout time of the ping operation is 10s, and the ping is performed for 3 times. Thus, the ping detection requires at most 30 seconds to obtain a detection result. During this period, it is necessary to determine whether the ping process is idle. For example, whether the ping process is idle may be determined according to a set flag bit. For example, if the flag bit is 0 and is idle, S304 is executed. If the ping process is not idle, that is, the state of performing ping detection on the last structured information is still currently performed, the last structured information is not processed, in this case, the diagnostic module does not process the newly reported structured information, and optionally, the newly reported structured information may be discarded.

Alternatively, the diagnostic module may create a temporary directory/var/tcps lowdetect for storing temporary files of the ping.

S304, recording each device in the structured information.

In some embodiments, the diagnostic module loops through the information of each device in the structured information. The state of each device is updated from initialization to detection. And performing ping LAN side equipment diagnosis operation on equipment with LAN side time delay timeout or in a to-be-sampled state. If the LAN side device is a wireless internet surfing device, wi-Fi information needs to be acquired. The ping LAN side device is for each device that has a LAN side latency timeout. Because the router is the same, if the WAN side time delay of a plurality of devices is overtime, ping detection needs to be carried out on each device, and based on the method, whether at least one device has the WAN side time delay overtime is needed to be judged, and then the WAN side operation is carried out once.

Specifically, the ping detection for the LAN side includes:

and the diagnosis module acquires structural body information by taking the MAC as an index according to the structural information, wherein the structural body information comprises information such as IP addresses, MAC addresses, network port names, handshake delay detection results and the like of all the devices.

Alternatively, the diagnostic module may obtain universal time (universal time coordinated, UTC time). Illustratively, the diagnostic module may obtain UTC time via a function gettimeofidy, convert world universal time to local time via a preset conversion function localname_r, convert local time to a time string of year-month-day-time-minute-second "% Y-% > M-% > d% H:% M:% S" via a preset conversion function strftime, and record into a time parameter.

The diagnostic module sets the status of the current device from the initialization INIT to the in-detect TRIGGER.

After updating the state of the current equipment, the diagnosis module backs up the handshake delay detection result and the delay parameter of the current equipment according to the structured array respectively. Judging whether the current equipment is wireless internet surfing equipment or wired internet surfing equipment according to the judgment of whether the network port name is a beginning character string of wl. For example, if the portal name is a beginning string, the wireless internet access device is provided. The rest is the wired internet equipment. If the current device is a wireless internet surfing device, obtaining information related to wireless connection through a preset function ioctl, for example, obtaining information such as signal strength (-100-0 DB), negotiation rate (unit Mbps) and the like of the current device, and recording the information into a ping detection result of the current device.

And the diagnosis module determines that the time delay of the LAN side is overtime or sampling is needed according to the handshake time delay detection result, and LAN side ping detection is needed for the equipment.

Illustratively, the ping instruction of the terminal with the ping IP address 192.168.3.2 is:

ping-c 3-W 10000 192.168.3.2>/var/tcpSlowDetect/ping12:34:56:78:9A:BC.log&

wherein, -c 3 represents ping3 times; -W10000 represents each timeout time 10000ms; and the execution of the background is indicated, namely the program continues to run downwards after starting the ping, and the waiting of the ping result is not required to be blocked.

The detection result of ping is written into a specified directory file, such as directory file is/var/tcpSlowdetection/ping 12:34:56:78:9A:BC.log.

Wherein 12:34:56:78:9A:BC is the MAC address of the terminal with IP address 192.168.3.2. The IP address of the terminal can be acquired through a node- > ipAddr and converted into a character string through an inet_ntop; the MAC address of the terminal can be obtained through node- > MAC and converted into a character string through inet_ntop.

Based on the above ping detection, a ping detection result of the LAN side device (terminal with IP address 192.168.3.2) can be obtained.

S305, judging whether at least one device WAN side time delay is overtime or in a state needing to be sampled.

In some embodiments, if there is at least one device WAN side time delay timeout or in a state to be sampled, a WAN side ping detection is performed, and the diagnostic module performs a ping detection on the corresponding device. If there is no time-out of the WAN side delay of any device, or there is no state that any device is in a state to be sampled, S306 is executed.

In some embodiments, ping detection is performed for the WAN side. The diagnosis module traverses the structural information of the current equipment and records whether WAN diagnosis is carried out in the reporting process through a preset zone bit. For example, the preset flag bit may be wanHasping. Therefore, when a plurality of devices exist at the same time and need to ping the WAN side, the same diagnosis process and result can be multiplexed. When the preset flag bit wanHaspin is false, the device is indicated to have not performed WAN diagnosis yet, if the device handshake delay detection result has WAN side delay timeout or needs sampling, ping detection is performed, wanHaspin is changed into true, and then other devices reported this time do not perform WAN diagnosis any more.

In some embodiments, the WAN diagnostic instructions are as follows, which in turn starts a ping upstream gateway (the router's next hop address) and a ping wide area network, where the destination address of the wide area network may employ two probe servers in the home or standby, or other public network addresses.

And performing WAN side ping detection, wherein the ping instruction is as follows:

ping-c3-W1000010.0.0.1>/var/tcpSlowDetect/pingGate.log&

ping-c3-W10000connectivitycheck.platform.hihonorcloud.com>/var/tcpSlowDetect/pingWan.log&

ping-c3-W10000connectivitycheck-backup.platform.hihonorcloud.com>/var/tcpSlowDetect/pingWanBak.log&

wherein, -c3 represents ping3 times; -W10000 represents each timeout time 10000ms; and the execution of the background is indicated, namely the program continues to run downwards after starting the ping, and the waiting of the ping result is not required to be blocked.

pingGate refers to a ping upstream gateway (the next hop address of the router); pingWan and pingWanBak refer to ping primary and secondary probing servers.

The ping detection result may be recorded in directory/var/tcpSlowDetect.

S306, starting a ping detection waiting timer.

In some embodiments, the diagnostic module creates a ping detection timer, which may be 30 seconds in timing, i.e., processing of the ping result is performed every 30 seconds.

S307, the ping detection is completed.

Through S304 and S305, a plurality of ping detection result files of terminals with suspicion of LAN side delay timeout and up to 1 group of ping detection result files of WAN side gateway+wide area network will be generated under the directory/var/tcps lowdetect.

In some embodiments, the diagnostic module may need to process the ping detection results.

The processing of the WAN side ping detection result includes:

if there is a ping detection result file of the ping uplink gateway (the next hop address of the router), for example, a ping gate.log, a key string of "min/avg/max=" is searched from the file line by line, and the key string identifies the minimum value, the average value and the maximum value of the three ping detection time results of the device. And obtaining the first floating point number, namely the minimum delay of the ping detection time result. Through practical tests, when a terminal is ping, the time delay of the first ping is always larger, probably because the terminal ping message receiving module is in a dormant state, so that errors caused by dormancy can be avoided by 3 times of ping, the minimum ping time delay in 3 times is selected as the standard, and a millisecond value is recorded in a temporary variable pingGateTmp.

If there are ping detection result files of the two probing servers, such as ping Wan.log and ping WanBak.log. And obtaining the minimum value of the ping detection time result in the ping Wan.log and the minimum value of the ping detection time result in the ping WanBak.log from the ping Wan.log and the ping WanBak.log, respectively recording the minimum value of the ping detection time result in the ping Wan.log and the minimum value of the ping detection time result in the ping WanBak.log in temporary variables, and recording the minimum value in the temporary variables ping WanTmp. The minimum value is selected as the result of the main server and the standby server, so as to avoid the influence of ping failure or delay on the accuracy of the result caused by the abnormality of a certain server.

Processing the LAN side result ping detection result, comprising: if a file in the format of ping12:34:56:78:9A:BC.log exists, acquiring the minimum value of the three times of ping detection time results from the file, corresponding to a certain terminal through an MAC address, and assigning the minimum value of the three times of ping detection time results to the ping dev time delay parameter in the ping detection result of the single device.

In some embodiments, the diagnostic module may transmit the ping detection result after processing to the processing module. And the processing module analyzes the ping detection result to obtain a ping detection analysis result. Optionally, the ping detection analysis result may be reported to an analysis server and saved to a local storage space.

The diagnostic module has set the device correspondence detection state to the in-detect TRIGGER upon initiation of the ping detection. The processing module traverses all the devices in the structural body information, and further processes the device with the state set as TRIGGER to obtain ping detection results of all the devices. The ping detection analysis result mainly comprises an internal error code and a data description character string.

Illustratively, tcpslowchr is an internal error code, and the values are, from left to right, respectively, as viewed in bytes, downwired/downwireless/next-hop/extranet server

The structure of the ping detection result is as follows:

typedefenum{

detecting server failure condition

WAN_NORMAL_E＝(0x00<<0),

WAN_SLOW_E＝(0x01<<0),

WAN_DISCON_E＝(0x02<<0),

Next hop failure condition

GATE_NORMAL_E＝(0x00<<8),

GATE_SLOW_E＝(0x01<<8),

GATE_DISCON_E＝(0x02<<8),

Wireless fault condition of drop

WLAN_NORMAL_E＝(0x00<<16),

WLAN_SLOW_E＝(0x01<<16),

WLAN_DISCON_E＝(0x02<<16),

WLAN_STATE_E＝(0xFF<<16),

Drop wire fault condition

LAN_NORMAL_E＝(0x00<<24),

LAN_SLOW_E＝(0x01<<24),

LAN_DISCON_E＝(0x02<<24),

}TcpSlowInnerReasonE；

And different analysis processing is carried out on ping detection results of different sides.

Illustratively, ping detection results for WAN side:

if the device is found to be slow in WAN or needs to be sampled for the first time, whether WAN side time delay timeout (wanslow) exists is confirmed by combining the ping detection result.

Illustratively, obtaining a ping detection time pingGateTmp of a ping uplink gateway, judging whether the pingGateTmp is greater than a first threshold value conn_block_threshold, if the pingGateTmp is greater than the first threshold value, considering that the network is not through, and recording a 'gatedicon' in data of structured data according to bit or gate_discon_e; ". If the pinggateTmp is smaller than or equal to the first threshold value, judging whether the pinggateTmp is larger than the second threshold value GATE_SLOW_THRESHOD, if the pinggateTmp is larger than the second threshold value, the error code is bit-wise or LAN_SLOW_E, and the data in the structured data additionally records' gateSlowrtt [%u ]; ", where% u is the value of pingGateTmp.

Illustratively, obtaining ping detection time ping wantmp of the ping wide area network, judging whether the ping wantmp is greater than a first threshold value conn_block_threshold, if the ping gateway tmp is greater than the first threshold value, considering that the network is not connected, and recording "wanDiscon" in data in the structured data according to bit or wan_discon_e of an error code; ". If the pingWanTmp is smaller than or equal to the first threshold value, judging whether the pingWanTmp is larger than the second threshold value gate_slow_threshold, if the pingWanTmp is larger than the second threshold value, additionally recording' wanslowtt [%u% u ] in data of structured data according to bit or WAN_SLOW_E of error codes; ", where% u is the value of tcph and rtt1-2 handshake rtt and pingWanTmp, respectively.

Illustratively, ping detection results for a LAN-side wired internet device:

if the wired terminal is found to have a slow LAN or needs to be sampled, it needs to be confirmed by combining the ping result whether the LAN side delay time out (lanslow) exists.

Acquiring ping round trip delay (ping DevRt) of a ping terminal, judging whether the ping DevRt is larger than a first threshold value CONN_BLOCK_THRESHOD, if the ping DevRt is larger than the first threshold value, considering that the network is not communicated, and recording' landisconoma [%s ] in data in structured data according to bit or CHR_LAN_DISCON_E; ". If the pingDevRtt is smaller than or equal to the first threshold, judging whether the pingDevRtt is larger than the second threshold LAN_SLOW_THRESHOD, if the pingDevRtt is larger than the second threshold, bit-wise or CHR_LAN_SLOW_E is carried out on an error code, and' lanSlow mac [%s ] rtt [%u ] is additionally recorded in data in the structured data; ". Where MAC [%s ] is the device MAC address, e.g., 12:34: BC, MAC address may be an address subjected to obfuscation, so as to improve security of user information. rtt [%u% u ] is the value of tcph and rtt2-3 handshake rtt and pingDevRtt, respectively.

Illustratively, ping detection results for LAN-side wireless networking devices:

if the wireless terminal is found to have a slow LAN or needs to be sampled, it needs to be confirmed by combining the ping result whether the LAN side delay time out (lanslow) exists.

Acquiring ping round trip delay (ping DevRt) of a ping terminal, judging whether the ping DevRt is larger than a first threshold CONN_BLOCK_THRESHOD, if the ping DevRt is larger than the first threshold, considering that the network is not communicated, and recording' WLAN disconomac [%s ] ifc [%s ] rssi [%d ] txRate [%u ] rxRate [%u ] in data of structured data according to bits or WLAN_DISCON_E; ". If the pingDevRtt is smaller than or equal to the first threshold, judging whether the pingDevRtt is larger than a second threshold WLAN_SLOW_THRESHOD, if the pingDevRtt is larger than the second threshold, additionally recording' WLAN SLOW mac [%s ] rtt [%u% u ] ifc [%s ] rssi [%d ] txRate [%u ] rxRate [%u ] in data of structured data according to bit or WLAN_SLOW_E; ".

Wherein ifc [%s ] is the network port name; wl0 represents 5Gwifi connection between the device and the router, and wl1 represents 2.4Gwifi; rssi [%d ] is wifi signal intensity, the range is-100-0, unit DB; txRate [%u ], rxRate [%u ] wifi negotiates transmission/reception rate, unit Mbps, respectively. Ranging from 0 to several thousand.

Optionally, in some embodiments, if the device to be sampled exists in the report, the processing module may cache the WAN side ping detection analysis result and the LAN side ping detection analysis result of the device, for later use.

In some embodiments, after the processing module obtains the ping detection analysis result of each device, the temporary directory used for temporarily storing each device may be deleted, for example, the temporary directory may be/var/tcps lowdetect.

After the ping detection analysis result is obtained, the processing module can report the ping detection analysis result to the analysis server.

In some embodiments, the processing module may need to convert an internal error code in the ping detection analysis result to an external error code. For example, the internal error code is in a bitmap format, and is inconvenient to read when being reported to the analysis server. The external error code is converted, so that the reading of maintenance personnel of the analysis server can be facilitated.

In some embodiments, the ping detection analysis result reported by the processing module may include reporting event identification, detection result, detection parameter, etc. By way of example, the event identification may be an event ID, an event name, etc. The detection result may include detection situations of the terminal and the network device, for example, detection situations of the wireless internet device, detection situations of the wired internet device, detection situations of the detection server, detection situations of a next hop address of the router, and the like. The detection parameters may include a handshake round trip delay, a ping delay, etc. corresponding to each terminal. For wireless networking devices, the detection parameters also include signal strength, reception rate, transmission rate, etc.

In some embodiments, an example of reporting a ping detection analysis result is given, where the example includes:

(1) The event number, for example, 1XXXXX8, and specific data are located in the event report attached file tcpSlowList.

(2) The whole condition (error code) of this detection, the numerical value is 10 system format, look at 5 bits altogether from left to right, every bit number is respectively:

whether there is history data: 1 is none, 2 is one

Detecting conditions of the down-hanging wired internet equipment: 0 is normal, 1 is slow in existence response, 2 is no response in existence

Detecting conditions of the down-hanging wireless internet equipment: 0 is normal, 1 is slow in existence response, 2 is no response in existence

Detection of the next hop: 0 is normal, 1 is slow in existence response, 2 is no response in existence

Detection of wide area network: 0 is normal, 1 is slow in existence response, 2 is no response in existence

Illustratively, 10001 represents the problem between a light cat to a wide area network without historical data. 20100 represents that LAN-side wireless internet access devices have problems and have history data.

(3) WAN side and specific case of each LAN side device (data parameter of chr_upload).

The character string is separated by a semicolon (maximum 10 kB), comprising:

gateSlowrtt [%u ] indicates that the ping gateway is slow;

wanslowt [%u% u ] indicates that the ping wide area network is slow;

lanSlowmac [%s ] rtt [%u% u ] indicates that the ping wired internet device is slow;

wlan slow [%s ] rtt [%u ] ifc [%s ] rsti [%d ] txRate [%u ] rxRate [%u ] indicating that the ping wireless internet device is slow.

Wherein, rtt has 2 parameters, parameter 1 represents the tcp handshake rtt delay of the bottom layer, and parameter 2 represents the ping delay of the upper layer.

In practical application, the processing module reports the ping detection analysis result to the analysis server when the statistic reaches a certain value, so that the interaction times are reduced, and the interaction resources are saved.

In some embodiments, the ping detection analysis results reported by the processing module may include a single ping detection analysis result. The single ping detection analysis result can comprise the current system time and the detection parameters corresponding to the terminal. The detection parameters may include WAN side delay and LAN side delay. In the case that the terminal is a wireless internet device, the detection parameters may also include signal strength, transmission rate, reception rate, and so on.

Illustratively, a single reporting case may refer to the following:

2022-09-3011:41:33wanSlowrtt[50202]；wlanSlowmac[E2:**:**:DA:**:55]rtt[4045]ifc[wl0]rssi[-54]txRate[960]rxRate[648]；

in some embodiments, the second threshold in the ping detection process is dynamically calculated and determined by the analysis server according to the sampling data of the processing module. Illustratively, the analysis server may determine the second threshold according to the 90% principle. And obtaining a final ping result according to the first threshold value and the second threshold value.

Illustratively, it comprises:

reporting tcp1-2:60ms—slow for the possible WAN side;

reporting tcp2-3:30ms—slow for the possible LAN side;

gate_slow_threshold (SLOW but ping enabled): 20ms of

Wan_slow_threshold (pingwan SLOW but pingable): 60ms

Lan_slow_threshold (ping LAN SLOW but capable of ping on): 20ms of

WLAN _ SLOW _ threshold (ping WLAN SLOW but ping on): 60ms

Conn_block_threshold (ping timeout not ping pass): 10s

The ping result information is uploaded to an analysis server for recording through a common http or https protocol. The ping result information comprises event identification, the technical field of abnormality, event meaning, fault level, fault reason and reporting time. Wherein the event identification may be an event ID. The technical field is determined according to the technical field divided in advance, and the technical field comprises a network protocol, network equipment and the like. The meaning of an event refers to the explanation of an abnormal event, for example, no TCP answer at WAN side, no answer at terminal, etc. The fault level is determined according to a preset level classification, for example, the fault level includes a level a, a level B, and a level C, and illustratively, the level a fault level is the highest, the level C fault level is the lowest, or the level a fault is the lowest, and the level C fault is the highest. The number and degree of the fault levels are determined according to actual conditions. The fault cause refers to a cause of an abnormal event, for example, the fault cause of no TCP response at the WAN side is a network device abnormality, and when information is reported, an identifier corresponding to the network device abnormality is reported, for example, the identifier of the network device abnormality is 10200 and the like. An example is given in table 4 below, where the analysis server may present the raw data as shown in the table below:

TABLE 4 Table 4

Illustratively, confirming that a wireless device is down-hung by an event error code may be referred to as shown in the following table:

TABLE 5

WAN no TCP acknowledgement

C

10100

2011-10-11 11:04:48

HLB-600

The reason why the log information confirmation through the attachment causes the slow surfing may be that the wifi rx negotiation rate is low. The log information is:

2022-10-11 11:04:48 wlanSlow mac[D6:**:**:09:**:22]rtt[4069]ifc[wl1]rssi[-49]txRate[104]rxRate[8]

illustratively, validating the gateway to the wide area network by an event error code may be referred to as shown in the following table:

TABLE 6

The log display monitoring module of the attachment records that the connection of the user and the ping detection server result of the application layer router are 90ms, and the current universal delay of the cat to the wide area network and the problem of the non-router to the next hop are described. The log information is:

2022-10-1111:38:38wanSlowrtt[9097]

considering that there may be frequent reporting events (tcpslow events) of the ping result, in practical application, multiple reporting may cause the analysis server to traffic too frequently. Thus, the method is applicable to a variety of applications. And when the ping result of the processing module reports an event, judging whether the time difference between the current time and the last time exceeds a time threshold value, and reporting every 6 hours most frequently. If the time threshold is not exceeded, data information of the tcpslow event is accumulated and cached in a file; if the time threshold is exceeded, the processing module may report a tcpslow event to the analysis server.

A flow chart is presented in connection with fig. 6. The processing module is used for determining the handshake time delay between the terminal and the target device in the process of the monitoring module and performing ping detection in the process of the diagnosis module. The processing module may report the sampled data to an analysis server by timing sampling, the analysis server determining a handshake delay threshold and a ping delay threshold.

The processing module performs tcp delay detection sampling dotting, and dotting information can comprise equipment types, delay between tcp1-2 handshakes, delay between tcp2-3 handshakes and ping detection results. Including, for example, ping gateway latency, ping wide area network latency, and ping device latency. In the case that the terminal is a wireless internet device, the dotting information may further include information such as signal strength, transmission rate, reception rate, and the like.

In one example, the data format of the dotting event may be expressed as:

{"type":"％s","tcp_rtt1":％d,"tcp_rtt2":％d,"ping_gate":％d,"ping_wan":％d,"ping_dev":％d,"rssi":％d,"rx_rate":％d,"tx_rate":％d}

wherein, type represents the device type, the beginning of eth0.x/wl0/wl1 is LAN side wireless internet device; eth0.X is a LAN-side wired internet device. tcp_rt1 represents the time delay between tcp1-2 handshakes in milliseconds. tcp_rt2 represents the time delay between tcp2-3 handshakes in milliseconds. ping _ gate represents the ping gateway delay in milliseconds. ping wan represents the ping wide area network delay in milliseconds. ping_dev represents the ping device delay in milliseconds. rssi represents signal strength, valid only when type is wifi. rx_rate represents the reception rate in Mbps, valid only when type is wifi. tx_rate represents the transmission rate in Mbps, valid only when type is wifi.

Optionally, the bearing capacity of the analysis server is limited, and after the first dialing is successful after the router is started, the processing module reports the first time to the analysis server, and then reports the first time every 24 hours. The processing module of the router adds a point report name wan _tcp_sample to report through http or https protocol.

In the case of a large number of users using routers, the dotting data can fully describe the average internet surfing delay of the current user. The handshake delay threshold involved in the network diagnostics procedure of the router and the second threshold involved in the ping detection may be determined by means of data statistics, such as a median or mode of reference. And the dynamic updating of the threshold value is realized by sending the configuration interface to each router.

Referring to fig. 17, fig. 17 shows a schematic structure of a router for uploading sampled data to an analysis server. The ping detection module of the router reports the diagnosis result to the analysis server, and a developer can remotely log in the analysis server to inquire the collected network information and fault reasons, problem points and the like. The analysis server may include a plurality of servers, for example, report the event currently having a fault to the analysis server 1, where the event includes ping detection data and initial judgment results; and reporting the data of the random sampling router to the analysis server 2, wherein the data of the random sampling router comprises sampling results of all sampling points and is used for analyzing the network running state of the whole router by big data.

Optionally, the router may also issue the ping detection analysis result to the terminal. Referring to fig. 18, fig. 18 shows a flowchart of the router sending the alert message to the handset. For example, when the router finds that the current network state of the mobile phone on the LAN side is poor, a prompting message is sent to the mobile phone to notify the mobile phone that Wi-Fi network optimization needs to be performed, so that the wireless terminal displays corresponding prompting information on a display interface of the wireless terminal, and guides a user to make adjustment, thereby obtaining better internet surfing experience.

The router diagnosis module receives the structured information transmitted by the router monitoring module, and carries out ping detection operation according to the handshake delay detection result of each device. Further determining whether the reason for the network slowness is at the gateway, wide area network or LAN side is that a point of failure of the network slowness can be accurately located. Moreover, the method can automatically finish detection, diagnosis and optimization of the network under the condition that the user perceives weak or does not perceive aiming at the terminal, thereby improving the user experience.

Fig. 19 shows a possible structural schematic diagram of the electronic device involved in the above embodiment. As shown, includes a processor 1001, a communication module 1002, and a storage module 1003.

The processor 1001 may be a central processing unit (central processing unit, CPU), a digital signal processor (digital signal processor, DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (field programmable gate array, FPGA) or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. The processor may include an application processor and a baseband processor. Which may implement or perform the various exemplary logic blocks, modules, and circuits described in connection with this disclosure. The processor may also be a combination that performs the function of a computation, e.g., a combination comprising one or more microprocessors, a combination of a DSP and a microprocessor, and the like. The communication module 1002 may be a transceiver, transceiver circuitry, or the like. For example, the communication module 1002 may include a Wi-Fi module, a bluetooth module, a radio frequency module, and the like. The memory module 1003 may be a memory.

Embodiments of the present application also provide a system-on-a-chip (SoC) including at least one processor 701 and at least one interface circuit 702, as shown in fig. 20. The processor 701 and the interface circuit 702 may be interconnected by wires. For example, interface circuit 702 may be used to receive signals from other devices (e.g., a memory of an electronic apparatus). For another example, interface circuit 702 may be used to send signals to other devices (e.g., processor 701 or a camera of an electronic device). The interface circuit 702 may, for example, read instructions stored in a memory and send the instructions to the processor 701. The instructions, when executed by the processor 701, may cause the electronic device to perform the various steps of the embodiments described above. Of course, the chip system may also include other discrete devices, which are not specifically limited in this embodiment of the present application.

Embodiments of the present application also provide a computer-readable storage medium including computer instructions that, when executed on an electronic device described above, cause the electronic device to perform the functions or steps performed by the electronic device 100 in the method embodiments described above.

Embodiments of the present application also provide a computer program product which, when run on a computer, causes the computer to perform the functions or steps performed by the electronic device 100 in the method embodiments described above. For example, the computer may be the electronic device 100 described above.

It will be apparent to those skilled in the art from this description that, for convenience and brevity of description, only the above-described division of the functional modules is illustrated, and in practical application, the above-described functional allocation may be performed by different functional modules according to needs, i.e. the internal structure of the apparatus is divided into different functional modules to perform all or part of the functions described above.

In the several embodiments provided in this application, it should be understood that the disclosed apparatus and method may be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative, e.g., the division of the modules or units is merely a logical functional division, and there may be additional divisions when actually implemented, e.g., multiple units or components may be combined or integrated into another apparatus, or some features may be omitted, or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.

The units described as separate parts may or may not be physically separate, and the parts displayed as units may be one physical unit or a plurality of physical units, may be located in one place, or may be distributed in a plurality of different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in software functional units.

The integrated units, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a readable storage medium. Based on such understanding, the technical solution of the embodiments of the present application may be essentially or a part contributing to the prior art or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium, including several instructions for causing a device (may be a single-chip microcomputer, a chip or the like) or a processor (processor) to perform all or part of the steps of the methods described in the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read Only Memory (ROM), a random access memory (random accessmemory, RAM), a magnetic disk, or an optical disk, or other various media capable of storing program codes.

The foregoing is merely a specific embodiment of the present application, but the scope of the present application is not limited thereto, and any changes or substitutions within the technical scope of the present disclosure should be covered in the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A method of network diagnostics, the method comprising:

the routing equipment generates handshake interaction information corresponding to the terminal; the handshake interaction information comprises an identifier of a terminal and an identifier of network equipment which establishes a transmission layer control protocol (TCP) connection with the terminal;

the routing equipment records a first handshake time delay corresponding to the network equipment in handshake interaction information of a terminal corresponding to the network equipment; the first handshake delay is the delay between sending handshake request information to the network equipment by the routing equipment and receiving handshake response information corresponding to the handshake request information from the network equipment by the routing equipment; the handshake request information is used for requesting the terminal to establish TCP connection with the network equipment;

the routing equipment records a second handshake time delay corresponding to the terminal in handshake interaction information of the terminal; the second handshake delay is the delay between sending handshake response information to the terminal by the routing equipment and receiving handshake confirmation information corresponding to the handshake response information from the terminal by the routing equipment;

The routing equipment counts a first handshake delay and a second handshake delay of the TCP connection between the terminal and the corresponding network equipment;

the routing equipment determines a first network equipment and a first terminal; the first network device is a network device with a first handshake time delay greater than a first time delay threshold for establishing TCP connection; the first terminal is a terminal with a second handshake time delay greater than a second time delay threshold for establishing TCP connection;

the routing equipment carries out ping detection on first network equipment to acquire a network state between the routing equipment and the first network equipment; the network state comprises network normal, network delay or network disconnection;

2. The method of claim 1, wherein the step of determining the position of the substrate comprises,

the routing device performs ping detection on a first network device, including:

the routing equipment sends a ping instruction to the first network equipment according to a first period;

the routing device performs ping detection on a first terminal, and the method comprises the following steps:

and the routing equipment sends a ping instruction to the first terminal according to a first period.

3. The method of claim 2, wherein the obtaining the network state between the routing device and the first network device comprises:

and if the routing equipment does not receive the response of the first network equipment to the ping instruction within a first time period after the routing equipment sends the ping instruction, the routing equipment determines that the network state between the routing equipment and the first network equipment is network disconnection.

4. The method of claim 2, wherein the obtaining the network state between the routing device and the first network device comprises:

if the routing device receives a response of the first network device to the ping instruction within a first time period after sending the ping instruction;

the routing equipment obtains a first response time delay from sending the ping instruction to receiving a response of the first network equipment aiming at the ping instruction;

and if the routing device determines that the first response time delay is greater than a first threshold value, the routing device determines that the network state between the routing device and the first network device is a network delay.

5. The method of claim 2, wherein the obtaining the network state between the routing device and the first network device comprises:

and if the routing equipment determines that the first response time delay is smaller than a first threshold value, the routing equipment determines that the network state between the routing equipment and the first network equipment is normal.

6. The method of claim 3, wherein the first network device comprises a first probe server and a second probe server,

the routing device sends a ping instruction to the first network device according to a first period, and the method comprises the following steps:

the routing equipment respectively sends ping instructions to the first detection server and the second detection server according to the first period;

the obtaining the network state between the routing device and the first network device includes:

and if the routing equipment does not receive the responses of the first detection server and the second detection server to the ping instruction within a first time period after the sending of the ping instruction, the routing equipment determines that the network state between the routing equipment and the first network equipment is network disconnection.

7. The method according to any one of claims 3-6, further comprising:

the routing equipment generates a first network identifier according to the network state between the routing equipment and the first network equipment;

and the routing equipment records the first network identifier in handshake interaction information of the terminal corresponding to the first network equipment.

8. The method of claim 2, wherein the obtaining the network state between the routing device and the first terminal comprises:

and if the routing equipment does not receive the response of the first terminal to the ping instruction within a second time period after the routing equipment sends the ping instruction, the routing equipment determines that the network state between the routing equipment and the first terminal is network disconnection.

9. The method of claim 2, wherein the obtaining the network state between the routing device and the first terminal comprises:

if the routing equipment receives a response of the first terminal to the ping instruction within a second time period after sending the ping instruction;

the routing equipment acquires a second response time delay from sending the ping instruction to receiving the response of the first terminal to the ping instruction;

And if the routing equipment determines that the second response time delay is larger than a second threshold value, the routing equipment determines that the network state between the routing equipment and the first terminal is network delay.

10. The method of claim 2, wherein the obtaining the network state between the routing device and the first terminal comprises:

and if the routing equipment determines that the second response time delay is smaller than a second threshold value, the routing equipment determines that the network state between the routing equipment and the first terminal is normal.

11. The method according to any one of claims 8-10, further comprising:

the routing equipment generates a second network identifier according to the network state between the routing equipment and the first terminal;

and the routing equipment records the second network identifier in handshake interaction information corresponding to the first terminal.

12. The method according to claim 1, wherein the method further comprises:

if the routing equipment determines that the first terminal is a wireless internet terminal, acquiring a first communication parameter of the first terminal; the first communication parameters comprise network port identification, wireless signal strength, receiving rate and sending rate;

and the routing equipment records the first communication parameters in handshake interaction information corresponding to the first terminal.

13. The method according to claim 1, wherein the method further comprises:

if the routing equipment determines that the first terminal is a wired internet terminal, acquiring second communication parameters of the first terminal; the second communication parameters comprise a network port identifier and a local area network address of the terminal;

and the routing equipment records the second communication parameters in handshake interaction information corresponding to the first terminal.

14. The method according to claim 1, wherein the method further comprises:

the routing equipment sends a test instruction to a second terminal according to a second period; the second terminal is any one of the terminals;

if the routing equipment does not receive the test response of the second terminal to the test instruction within a third time period after the test instruction is sent, the routing equipment records a first identifier in handshake interaction information of the second terminal; the first identifier is used for indicating that the second terminal and the routing equipment do not establish communication connection;

If the routing equipment receives a test response of the second terminal aiming at the test instruction in a first time period, the routing equipment records a second identifier in handshake interaction information of the second terminal; the second identifier is used for indicating that the second terminal establishes communication connection with the routing device.

15. The method according to any one of claims 1-6, further comprising:

and the routing equipment sends handshake interaction information to the server according to a third period.

16. The method of any of claims 1-6, wherein prior to the routing device ping the first network device, the method further comprises:

17. The method according to any one of claims 1-6, further comprising:

if the routing equipment determines that the network state between the routing equipment and the first network equipment is network delay or network disconnection, the routing equipment generates first network abnormality prompt information; the first network abnormality prompting information is used for prompting a user that network abnormality exists in first network equipment;

And the routing equipment sends the first network abnormity prompt information to the terminal.

18. The method according to any one of claims 1-6, further comprising:

if the routing equipment determines that the network state between the routing equipment and the first terminal is network delay or network disconnection, the routing equipment generates second network abnormality prompt information; the second network abnormality prompting information is used for prompting a user that the first terminal has network abnormality;

and the routing equipment sends the second network abnormality prompt information to the first terminal.

19. A network diagnostic method, comprising:

the server receives a plurality of handshake interaction information from the routing device; the handshake interaction information comprises a terminal identifier, an identifier of network equipment which establishes TCP connection with the terminal, a first network identifier and a second network identifier; the first network identifier is used for representing a network state between the routing equipment and the network equipment; the second network identifier is used for representing a network state between the routing equipment and the terminal; the network state comprises network normal, network delay or network disconnection; the handshake interaction information further comprises a first handshake delay, wherein the first handshake delay is the delay between the time when the routing equipment sends handshake request information to the network equipment and the time when the routing equipment receives handshake response information from the network equipment; the handshake request information is used for requesting the terminal to establish TCP connection with the network equipment; the handshake interaction information also comprises a second handshake delay, wherein the second handshake delay is the delay between the time when the routing equipment sends handshake response information to the terminal and the time when the routing equipment receives handshake confirmation information from the terminal;

The server analyzes the handshake interaction information to obtain fault information of the handshake interaction information; the fault information comprises a fault grade and a fault reason;

and the server outputs the handshake interaction information and fault information corresponding to the handshake interaction information.

20. The method of claim 19, wherein the server analyzing each of the handshake interaction information to obtain failure information of each of the handshake interaction information comprises:

the server determines the network state of the routing equipment and the first network equipment corresponding to the first handshake interaction information according to the first network identification of the first handshake interaction information; the first handshake interaction information is any one of the plurality of handshake interaction information;

and the server acquires the fault grade and the fault reason corresponding to the first handshake interaction information according to the network states of the routing equipment and the first network equipment.

21. The method of claim 19, wherein the server analyzing each of the handshake interaction information to obtain failure information of each of the handshake interaction information comprises:

The server determines the network states of the first terminal corresponding to the second handshake interaction information and the routing equipment according to the second network identification of the second handshake interaction information;

and the server acquires the fault grade and the fault reason corresponding to each piece of second handshake interaction information according to the network states of the first terminal and the routing equipment.

22. The method of claim 19, wherein the method further comprises:

the server sorts the first handshake time delays in the handshake interaction information from small to large, and the server determines the sorted Nth first handshake time delay as a first time delay threshold; wherein N is a first preset value, N is greater than 0 and less than or equal to a preset number; the first delay threshold is used for the routing equipment to judge whether communication delay abnormality exists between the routing equipment and the network equipment.

23. The method of claim 19, wherein the method further comprises:

the server sorts the second handshake time delays in the handshake interaction information from small to large, and the server determines the value of the M second handshake time delay after sorting as a second time delay threshold; m is a second preset value, and M is greater than 0 and less than or equal to the preset number; the second time delay threshold is used for judging whether communication time delay abnormality exists between the routing equipment and the terminal by the routing equipment.

24. The method of claim 19, wherein the handshake interaction information further comprises a first response time delay that is a time period between when the routing device sends a first test instruction to the network device and when the routing device receives a first test response to the first test instruction; the method further comprises the steps of:

the server sorts the first response time delays in the handshake interaction information from small to large, and the server determines the value of the sorted P first response time delay as a first threshold; wherein P is a first preset value, P is greater than 0 and less than or equal to a preset number; the first threshold is used for the routing equipment to judge whether a test response abnormality exists between the routing equipment and the network equipment.

25. The method of claim 19, wherein the handshake interaction information further comprises a second response time delay, the second response time delay being a time period between when the routing device sends a second test instruction to the terminal and when the routing device receives a second test response to the second test instruction; the method further comprises the steps of:

the server sorts the second response time delays in the handshake interaction information from small to large, and the server determines the value of the Q second response time delay after sorting as a second threshold value; q is a first preset value, Q is greater than 0 and less than or equal to a preset number; the second threshold is used for the routing equipment to judge whether a test response abnormality exists between the routing equipment and the terminal.

26. The method according to any one of claims 19-25, further comprising:

and the server sends the first delay threshold value, the second delay threshold value, the first threshold value and the second threshold value to the routing equipment.

27. An electronic device comprising a memory and one or more processors; the memory is coupled with the processor; the memory has stored therein computer program code comprising computer instructions which, when executed by the processor, cause the electronic device to perform the method of any of claims 1-26.

28. A computer readable storage medium comprising computer instructions which, when run on an electronic device, cause the electronic device to perform the method of any one of claims 1-26.