A self-diagnosis and analysis device for running state of network equipment

Abstract

The application discloses a kind of self-diagnosis and analysis device of network equipment operating state, it is related to network communication technical field.Device contains: time sequence characteristic acquisition module is connected to the console serial interface of target equipment, utilizes hardware counter to collect the time interval variance of physical level interruption to perceive time sequence entropy increase;Arbitration control module is based on the arbitration decision value of nonlinear logic calculation based on logarithmic damping and exponential recovery, only when meeting safe cooling condition, trigger detection;Abnormal injection module responds to trigger instruction, constructs transmission control protocol acknowledgement message of serial number out-of-bounds and sends to target equipment;State determination module monitors physical and network double channel feedback to confirm kernel deadlock state.The application triggers kernel level reverse verification by physical layer side channel feature, avoids the resource consumption of periodic detection to high load equipment, realizes the accurate determination to kernel deadlock state.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, and in particular to a self-diagnosis and analysis device for the operating status of network equipment. Background Technology

[0002] When core network devices face extreme conditions such as high-load critical states or kernel-level deadlocks, existing operation and maintenance monitoring technologies face a dilemma: balancing observational security with diagnostic certainty. In scenarios where the device's CPU utilization is near saturation or the operating system kernel is deadlocked, traditional periodic active probing methods, consuming the target device's remaining interrupt resources and protocol stack processing capabilities, are prone to the observer effect—the monitoring itself causing service avalanche or complete system crashes on high-load devices, thus compromising observation security. While traditional passive log monitoring avoids additional resource consumption, it suffers from state ambiguity due to its reliance on the normal operation of application-layer daemons. When the kernel protocol stack hangs, causing log output to stop, the operation and maintenance system cannot distinguish whether the device is in a busy state processing high-priority tasks or in a deadlock state where the kernel is completely unresponsive, thus lacking diagnostic certainty. Therefore, the industry lacks a technical solution that can accurately determine the kernel liveness status of network devices in a critical state without introducing additional computational load risks. Summary of the Invention

[0003] This invention provides a self-diagnosis and analysis device for the operating status of network devices, which aims to resolve the contradiction between observation security and diagnostic determinism under high load critical state by triggering kernel-level reverse verification through physical layer side channel characteristics.

[0004] In view of the above problems, the present invention provides a self-diagnosis and analysis device for the operating status of network devices, the device including a timing feature acquisition module, an arbitration control module, an anomaly injection module and a status determination module; The timing feature acquisition module is configured to connect to the console serial interface of the target network device, monitor the level status of the serial output signal from the target network device in real time, capture adjacent level interrupt signals using a hardware counter, and calculate the time interval variance between adjacent level interrupt signals. The arbitration control module is connected to the time-series feature acquisition module and is configured to receive the time interval variance and determine whether to generate a probe trigger command based on the nonlinear congestion determination logic. The nonlinear congestion determination logic is configured to: perform normalization and logarithmic damping processing on the time interval variance based on a pre-stored benchmark variance, and generate the probe trigger command only when the time interval variance after logarithmic damping processing is greater than a preset alarm threshold and the difference between the current time and the time when the probe trigger command was last generated is greater than a preset cooling time threshold. The anomaly injection module is connected to the arbitration control module and configured to connect to the management network interface of the target network device. The anomaly injection module is configured to construct a transmission control protocol acknowledgment message in response to the probe trigger command and send it to the target network device through the management network interface. The sequence number of the transmission control protocol acknowledgment message is set to a value outside the current receiving window of the target network device. The state determination module is configured to detect, within a preset listening time window after the exception injection module sends the transmission control protocol confirmation message, whether the management network interface receives a feedback message and whether the timing feature acquisition module captures a new level interrupt signal; if the management network interface does not receive the feedback message and the timing feature acquisition module does not capture a new level interrupt signal, then a kernel deadlock state signal is output.

[0005] Preferably, the arbitration control module calculates the arbitration decision value using the following arbitration decision formula. , and when When the value exceeds the alarm threshold, the detection trigger command is generated: in, This is the current value of the variance of the time interval. Let V be the baseline variance of the target network device. The time interval since the last generation of the detection trigger command is α, the sensitivity gain coefficient is τ, and the cooling time threshold is τ.

[0006] Preferably, the first term in the arbitration decision formula Configured as a logarithmic damping factor to suppress transient variance abrupt changes caused by poor physical interface contact; the second term in the arbitration decision formula Configured as an exponential recovery factor, it is used to establish a forced cooling mechanism for probing behavior to prevent denial-of-service attacks caused by continuous probing.

[0007] Preferably, the flag bit of the Transmission Control Protocol acknowledgment message constructed by the anomaly injection module is set to ACK, and the value of the sequence number is equal to the right boundary value of the current sliding window of the target network device plus a preset offset.

[0008] Preferably, the state determination module is configured to execute the following mutual exclusion determination logic: If, within the preset listening time window, the management network interface receives a transmission control protocol reset message, or the timing feature acquisition module captures a new level interrupt signal, then the device high load status signal is output, and the output of the kernel deadlock status signal is blocked.

[0009] Preferably, the device further includes a microcontroller unit, a level conversion circuit, and a physical layer transceiver; The microcontroller unit is electrically connected to the level conversion circuit and the physical layer transceiver, respectively. The level conversion circuit is configured to convert the RS-232 level of the console serial interface into a TTL level that can be processed by the microcontroller unit; The physical layer transceiver is configured to enable Ethernet physical layer communication between the microcontroller unit and the target network device.

[0010] The technical solution provided in this application has at least the following technical effects: By constructing a kernel-level reverse verification mechanism triggered by physical layer temporal entropy increases, this invention resolves the contradiction between observational security and diagnostic determinism in high-load network devices. This invention utilizes the temporal dispersion of the physical console interface as a no-load side-channel characteristic to detect system instability without interfering with the normal operation of the target device. Only when temporal entropy increases are detected and safe cooling conditions are met, a Transmission Control Protocol (TCP) message with an out-of-bounds sequence number is injected into the target device. Leveraging the operating system kernel's forced reset characteristic of low-level abnormal messages as a biological reflection mechanism, it achieves independent diagnosis of the kernel's survival status after application-layer failure. This adaptive diagnostic architecture, characterized by "silent perception under normal conditions and intervention on demand during anomalies," eliminates the resource contention risks associated with high-frequency active probing and fills the monitoring blind spots of passive listening in kernel deadlock scenarios, achieving lossless, accurate, and real-time determination of network device apparent dead states. Attached Figure Description

[0011] Figure 1 A schematic diagram of the module structure of the self-diagnosis and analysis device for the operating status of network devices provided in an embodiment of the present invention. Detailed Implementation

[0012] The above technical solutions will now be described in detail with reference to the accompanying drawings and specific embodiments to provide a better understanding of them. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. It should be understood that the present invention is not limited to the exemplary embodiments used only to explain the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention. Furthermore, it should be noted that, for ease of description, only the parts related to the present invention are shown in the drawings, not all of them.

[0013] For examples, please refer to Figure 1 A self-diagnosis and analysis device for the operating status of network devices, the device comprising a timing feature acquisition module, an arbitration control module, an anomaly injection module and a status determination module; The timing feature acquisition module is configured to connect to the console serial interface of the target network device, monitor the level status of the serial output signal from the target network device in real time, capture adjacent level interrupt signals using a hardware counter, and calculate the time interval variance between adjacent level interrupt signals. The arbitration control module is connected to the time-series feature acquisition module and is configured to receive the time interval variance and determine whether to generate a probe trigger command based on the nonlinear congestion determination logic. The nonlinear congestion determination logic is configured to: perform normalization and logarithmic damping processing on the time interval variance based on a pre-stored benchmark variance, and generate the probe trigger command only when the time interval variance after logarithmic damping processing is greater than a preset alarm threshold and the difference between the current time and the time when the probe trigger command was last generated is greater than a preset cooling time threshold. The anomaly injection module is connected to the arbitration control module and configured to connect to the management network interface of the target network device. The anomaly injection module is configured to construct a transmission control protocol acknowledgment message in response to the probe trigger command and send it to the target network device through the management network interface. The sequence number of the transmission control protocol acknowledgment message is set to a value outside the current receiving window of the target network device. The state determination module is configured to detect, within a preset listening time window after the exception injection module sends the transmission control protocol confirmation message, whether the management network interface receives a feedback message and whether the timing feature acquisition module captures a new level interrupt signal; if the management network interface does not receive the feedback message and the timing feature acquisition module does not capture a new level interrupt signal, then a kernel deadlock state signal is output.

[0014] To ensure the adaptability of the nonlinear congestion determination logic to different target network devices, the self-diagnosis and analysis device for network device operation status is configured with a baseline feature self-learning mode. Upon initial power-on or reset triggered by a physical button, the timing feature acquisition module enters a baseline sampling period (e.g., 60 seconds). During this period, the device remains silent and does not send probe commands. The timing feature acquisition module continuously calculates the real-time time interval variance of the console serial interface and calculates the arithmetic mean of all variance values ​​within this period. This arithmetic mean is marked as the baseline variance and written to the microcontroller's non-volatile memory (such as EEPROM or Flash). In subsequent normal operation mode, the arbitration control module reads this stored baseline variance and substitutes it into the arbitration decision formula, thereby eliminating background noise differences caused by serial port baud rates or clock drift of different target devices.

[0015] The self-diagnosis and analysis device for network device operation status is physically constructed as an independent embedded entity. The logic operation and control core of this device utilizes a microcontroller with a floating-point unit and a high-precision timer. Specific engineering choices include the STM32F407 series chip based on the ARM Cortex-M4 core, or, in scenarios with higher requirements for parallel processing timing accuracy, the CycloneIV series Field-Programmable Gate Array (FPGA) chip. The microcontroller, as the electrical control center of the self-diagnosis and analysis device, connects to the timing feature acquisition circuit and the network anomaly injection circuit via an onboard bus, establishing a hardware data path between physical layer signal processing and network layer packet construction.

[0016] It should be noted that the mapping relationship between functional modules and physical hardware entities is as follows: The timing feature acquisition module consists of an RS-232 level conversion circuit and the microcontroller's input capture timer at the hardware level; the arbitration control module consists of the microcontroller's floating-point unit (FPU) and its nonlinear congestion determination firmware logic at the hardware level; the anomaly injection module consists of an Ethernet physical layer transceiver circuit and the network protocol stack integrated within the microcontroller at the hardware level; and the status determination module consists of the microcontroller's synchronous listening timer and dual-channel signal detection logic circuit at the hardware level.

[0017] In the signal acquisition link for the physical console interface of the target network device, an RS-232 level conversion circuit is configured to solve the matching problem between the high-voltage logic of the target network device console interface and the low-voltage TTL logic of the microcontroller. The core component of the level conversion circuit is the MAX3232 level conversion chip. The charge pump circuit of the MAX3232 level conversion chip is externally connected to four 0.1 microfarad capacitors to maintain voltage boost and inversion functions. The receive channel input of the MAX3232 level conversion chip is connected to the data receiver of the physical interface. This data receiver is physically connected to the serial data transmission line (TXD) of the target network device and is configured in high-impedance input mode to prevent voltage drop or signal reflection interference to the original operation and maintenance communication when connected in parallel to the target network device console line. The TTL level signal converted by the MAX3232 level conversion chip is directly routed to the receive pin (e.g., PA10 pin) of the STM32F407 microcontroller's Universal Synchronous Asynchronous Transceiver (USART). The receive pin is configured in floating input mode and works with the microcontroller's internal advanced control timer TIM2 to capture the falling edge of the input signal.

[0018] In the probe link targeting the network interface of the target network device, an Ethernet physical layer transceiver circuit is integrated to implement physical layer encoding and transmission of TCP / IP protocol suite messages. The implementation component uses the LAN8720 Ethernet PHY chip, which connects to the Ethernet MAC peripheral of the STM32F407 microcontroller via the RMII Simplified Media Independent interface. The reference clock pin of the LAN8720 Ethernet PHY chip is connected to the PA1 pin of the microcontroller, and the data transmit pins TXD0 and TXD1 are connected to the PG13 and PG14 pins of the microcontroller, respectively. The analog front end of the LAN8720 Ethernet PHY chip is connected to the external network cable via an RJ-45 interface with an isolation transformer.

[0019] Based on physical hardware, the self-diagnostic and analysis device for network device operation status is accessed in the actual deployed physical topology via bypass listening. The DB9 physical interface of the device is connected in parallel to the Console debug port of the target network device (such as a core router or aggregation switch) via a Console-to-2 splitter cable, allowing unidirectional listening to level transition signals on the transmission line without intruding on the target network device's existing serial communication link. The RJ-45 Ethernet interface of the device is connected to the out-of-band management switch of the target network device via a twisted-pair cable or directly to the management port of the target network device. By configuring an IP address in the same network segment as the target network device, a network path capable of sending TCP / IP probe packets is established. This dual-line parallel physical connection architecture provides the hardware signal loop foundation for the subsequent microcontroller to sense temporal entropy increases at the physical layer and trigger network layer micro-perturbation injection.

[0020] The STM32F407 microcontroller's internal general-purpose timer TIM2 is initialized to input capture mode. The clock prescaler register PSC is configured according to the system bus clock frequency, fixing the timer TIM2's counting frequency to 1MHz, meaning each hardware counting cycle strictly corresponds to 1 microsecond of physical time. The receive pin (e.g., PA10 pin) of the Universal Synchronous Asynchronous Receiver / Asynchronous Transceiver (USART) is connected to the input capture channel of timer TIM2 via a multiplexed GPIO port. When the target network device sends character data through the console interface, the generation of the start-of-frame bit triggers a transition from logic high to logic low on the receive pin. The falling edge of this transition directly triggers the input capture hardware mechanism of timer TIM2, causing the contents of the current counter register CNT to be automatically latched into the capture compare register CCR. The interrupt service routine responds to the input capture interrupt, reads the value in the capture compare register CCR as the arrival timestamp of the current character, and temporarily writes the arrival timestamp value into the microcontroller's internal static random access memory (SRAM) for subsequent calculations.

[0021] The microcontroller's internal Static Random Access Memory (SRAM) pre-allocates a circular buffer structure of depth N (N is typically 50 in practical implementations). This circular buffer stores consecutive character arrival time intervals. Each time a new arrival timestamp is captured, the microcontroller's Arithmetic Logic Unit (ALU) executes a subtraction instruction, subtracting the previously captured arrival timestamp from the current timestamp to obtain the time interval between adjacent interrupt signals. To prevent overflow and wrapback issues that might occur with the timer / counter, the ALU performs a two's complement correction operation to ensure the non-negativity and monotonicity of the time interval value. The calculated time interval value is written to the memory location pointed to by the current write pointer in the circular buffer, overwriting the earliest written historical data. The write pointer then automatically increments or wraps back. After each update to the circular buffer data, the microcontroller executes a statistical variance calculation program: first, it accumulates all time interval values ​​in the circular buffer and divides them by the buffer depth N to obtain the arithmetic mean; then, it iterates through the circular buffer, calculating the square of the difference between each time interval value and the arithmetic mean; finally, it sums all the squares of the differences and divides them by the buffer depth N to obtain the variance of the time interval between adjacent interrupt signals. The time interval variance, as a physical index that quantifies the discreteness of the interrupt scheduling in the control plane of the target network device, is passed to the subsequent arbitration control logic module as an input parameter.

[0022] The arbitration control module utilizes the floating-point unit (FPU) of the STM32F407 microcontroller to execute nonlinear congestion determination logic. The arbitration control module calculates the arbitration decision value based on a preset arbitration decision formula. It generates a detection trigger command only when the arbitration decision value is greater than a preset alarm threshold. The specific mathematical expression of the arbitration decision formula is as follows: In the above formula, This represents the variance of the time interval calculated so far. This represents the baseline variance of the target network device pre-stored in Flash memory. The first term in the formula represents the difference between the current system time and the historical timestamp of the last time a detection trigger command was generated; α represents the sensitivity gain coefficient (e.g., set between 10 and 20); and τ represents the cooldown time constant (e.g., set between 5 and 10 seconds). Configured as a logarithmic damping factor. Utilizing the nonlinear characteristic of the logarithmic curve where the slope rapidly decreases when the independent variable is large, it dynamically compresses the transient maximum variance value caused by poor physical interface contact or electromagnetic interference. When physical line noise causes a non-logical sudden increase in the time interval variance value, the logarithmic damping operation maps the time interval variance value to a gradually increasing damped value, preventing the arbitration control module from being falsely triggered due to physical layer transient noise. The second term in the formula... Configured as the exponential recovery factor. The numerical range of the exponential recovery factor is strictly limited to between 0 and 1. When the time interval since the last probe is much shorter than the cooldown time constant, the exponential recovery factor approaches 0, leading to the final arbitration decision value. Approaching 0. Regardless of how large the variance of the input time interval is, an exponential recovery factor approaching 0 will force a lower arbitration decision value, thereby establishing a physically insurmountable silent window at the algorithm level. This prevents the self-diagnosis and analysis device of the network device's operating status from becoming a denial-of-service attack source due to continuous high-frequency sending of probe packets during periods of high failure incidence of the target network device.

[0023] The arbitration control module will calculate the arbitration decision value. The value is compared with a preset alarm threshold (e.g., 2.0). When the arbitration decision value is significantly greater than the alarm threshold, the arbitration control module determines that the current physical layer timing jitter characteristics meet the effective congestion conditions and comply with the safety cooling specifications. It then generates a probe trigger command and writes the current system time into the historical probe time register to reset the calculation benchmark for the next round of exponential recovery factor.

[0024] In response to the generated probe trigger command, the network anomaly injection circuit enters the working state. The STM32F407 microcontroller calls the RawSocket interface of the lightweight TCP / IP protocol stack LwIP to construct a specific Transmission Control Protocol (TCP) segment. In the TCP segment header structure, the destination port field is set to the open management port of the target network device (e.g., port 22 for SSH service or port 179 for BGP service), and the Flags field is forced to be in ACK state (binary 010000). The SequenceNumber field in the TCP segment header is assigned a specific value, which is calculated by the microcontroller based on the right boundary value of the currently tracked or estimated TCP receive window plus a preset offset (e.g., 1024), ensuring that the sequence number value falls strictly outside the target network device's currently valid TCP receive window.

[0025] Before responding to the probe trigger command and constructing a TCP packet, the device performs a physical link integrity pre-check. The microcontroller reads the Basic Status Register of the LAN8720 Ethernet PHY chip through the MDIO interface and checks the Link Status Bit. If the Ethernet physical link is detected to be in a link-down state, or if the timing feature acquisition module detects that the console interface line is in a continuous electrically floating state, the device will forcibly terminate the current probe process, output a "physical line fault" prompt signal, and lock the output of the kernel deadlock status signal to prevent accidental power reset operation due to physical cable detachment or breakage.

[0026] The constructed TCP segment, containing sequence number out-of-bounds characteristics, is transmitted to the LAN8720 Ethernet PHY chip via the Ethernet MAC peripheral and Direct Memory Access (DMA) controller. The LAN8720 Ethernet PHY chip converts the digital signal into an analog differential signal and injects it into the management network cable connecting the target network device. At the instant the Ethernet MAC peripheral triggers a frame transmission completion interrupt, the microcontroller reads the current high-precision timer count value and records it as the spatiotemporal alignment anchor timestamp T0. The spatiotemporal alignment anchor timestamp T0 is used as the zero-point reference for the subsequent heterogeneous response causal latching determination unit to open the listening window.

[0027] After recording the timestamp T0 of the spatiotemporal alignment anchor point, the state determination module immediately starts the synchronous listening timer. The synchronous listening timer is configured with a preset timeout threshold (e.g., 50 milliseconds) to define a strict temporal causality verification window. Within the verification window, the STM32F407 microcontroller executes a concurrent dual-channel listening process: on the network interface channel, the Ethernet MAC peripheral is set to capture mode to listen for incoming TCP segments targeting the source IP address; simultaneously, on the physical interface channel, the external interrupt controller connected to the receive pin of the general-purpose synchronous asynchronous transceiver remains active to detect any falling edge level transitions.

[0028] The status determination module performs mutual exclusion logic decisions based on events captured within the verification window. If the Ethernet interface receives a TCP segment with the RST flag set, or the external interrupt controller captures a new falling edge signal on the console interface line, the status determination module identifies the target network device as being under high load but with a live kernel. In this case, the status determination module keeps the internal deadlock flag set to False, thereby blocking the output channel of the kernel deadlock status signal and preventing the level toggling of GPIO pins. Conversely, if the verification window expires and the Ethernet interface does not receive any feedback messages while the console interface does not detect any new level signals, the status determination module determines that the target network device has entered a kernel deadlock state. After confirming the kernel deadlock state, the microcontroller toggles the logic level of a specific general-purpose input / output (GPIO) pin from low to high. The GPIO pins are electrically connected to the control terminals of external solid-state relays or power distribution units. The level toggling action of the GPIO pins triggers the relays to physically disconnect and subsequently restore the power supply to the target network device, thereby performing a hardware cold reboot to recover the target network device from the deadlock state.

[0029] To ensure the long-term reliability of the self-diagnostic and analysis device for network device operation status, an integrated hardware independent watchdog (IWDG) peripheral is activated within the microcontroller. This independent watchdog peripheral is driven by a dedicated low-speed clock source within the microcontroller and is electrically isolated from the system main clock. After each status determination, the microcontroller's firmware main loop logic performs a watchdog feed operation, writing a specific value to the independent watchdog's key register to reset the counter. If the microcontroller enters an infinite loop due to strong external electromagnetic interference or an internal bus error causing the program pointer to fly by, the independent watchdog's hardware counter will overflow after a preset timeout period (e.g., 2 seconds), directly triggering the microcontroller's internal reset circuit. This forces the self-diagnostic and analysis device for network device operation status to perform a hardware cold start, ensuring the device can automatically recover from its own faults and maintain continuous monitoring capabilities of the target network device.

[0030] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A self-diagnostic and analysis device for the operating status of network devices, characterized in that, The device includes a timing feature acquisition module, an arbitration control module, an anomaly injection module, and a status determination module. The timing feature acquisition module is configured to connect to the console serial interface of the target network device, monitor the level status of the serial output signal from the target network device in real time, capture adjacent level interrupt signals using a hardware counter, and calculate the time interval variance between adjacent level interrupt signals. The arbitration control module is connected to the time-series feature acquisition module and is configured to receive the time interval variance and determine whether to generate a probe trigger command based on the nonlinear congestion determination logic. The nonlinear congestion determination logic is configured to: perform normalization and logarithmic damping processing on the time interval variance based on a pre-stored benchmark variance, and generate the probe trigger command only when the value after logarithmic damping processing is greater than a preset alarm threshold and the difference between the current time and the time when the probe trigger command was last generated is greater than a preset cooling time threshold. The anomaly injection module is connected to the arbitration control module and configured to connect to the management network interface of the target network device. The anomaly injection module is configured to construct a transmission control protocol acknowledgment message in response to the probe trigger command and send it to the target network device through the management network interface. The sequence number of the transmission control protocol acknowledgment message is set to a value outside the current receiving window of the target network device. The state determination module is configured to detect whether the management network interface receives a feedback message and whether the timing feature acquisition module captures a new level interrupt signal within a preset listening time window after the exception injection module sends the transmission control protocol confirmation message; if the management network interface does not receive the feedback message and the timing feature acquisition module does not capture a new level interrupt signal, then a kernel deadlock state signal is output. The arbitration control module calculates the arbitration decision value using the following arbitration decision formula. , and when When the value exceeds the alarm threshold, the detection trigger command is generated. ; in, This is the current value of the variance of the time interval. The pre-stored benchmark variance, The time interval since the last generation of the detection trigger command is α, the sensitivity gain coefficient is τ, and the cooling time threshold is τ.

2. The self-diagnosis and analysis device for network device operating status according to claim 1, characterized in that, The first term in the arbitration decision formula Configured as a logarithmic damping factor to suppress transient variance abrupt changes caused by poor physical interface contact; The second term in the arbitration decision formula Configured as an exponential recovery factor, it is used to establish a forced cooling mechanism for probing behavior to prevent denial-of-service attacks caused by continuous probing.

3. The self-diagnosis and analysis device for network device operating status according to claim 1, characterized in that, The flag bit of the Transmission Control Protocol acknowledgment message constructed by the anomaly injection module is set to ACK, and the value of the sequence number is equal to the right boundary value of the current sliding window of the target network device plus a preset offset.

4. The self-diagnosis and analysis device for network device operating status according to claim 1, characterized in that, The state determination module is configured to execute the following mutual exclusion determination logic: If, within the preset listening time window, the management network interface receives a transmission control protocol reset message, or the timing feature acquisition module captures a new level interrupt signal, then the device high load status signal is output, and the output of the kernel deadlock status signal is blocked.

5. The self-diagnosis and analysis device for the operating status of network devices according to any one of claims 1 to 4, characterized in that, The device also includes a microcontroller unit, a level conversion circuit, and a physical layer transceiver; The microcontroller unit is electrically connected to the level conversion circuit and the physical layer transceiver, respectively. The level conversion circuit is configured to convert the RS-232 level of the console serial interface into a TTL level that can be processed by the microcontroller unit; The physical layer transceiver is configured to enable Ethernet physical layer communication between the microcontroller unit and the target network device.

Images