如图1-1，宽带网络是一个极其复杂的端到端系统，包括LAN侧和WAN侧。LAN侧指用户到AR这一段，包括FIT AP、S、用户终端等设备。WAN侧指AR到Internet之间，包括光猫、接入网、核心网设备，不过这些都是运营商提供的，与用户无关，不在本文讨论范围内。
如何测网速：
单上行出口上网慢：
（图1-2 单上行出口上网场景组网示例）
双上行/多上行出口上网慢：
图1-4是用户通过AR上网慢故障树，列出了单上行出口和双上行出口两种场景上网慢的常见原因。
报文分片导致部分网页打开慢：
背景信息
display ip interface brief
*down: administratively down
^down: standby
(l): loopback
(s): spoofing
(E): E-Trunk down
The number of interface that is UP in Physical is 2
The number of interface that is DOWN in Physical is 3
The number of interface that is UP in Protocol is 2
The number of interface that is DOWN in Protocol is 3 Interface IP Address/Mask Physical Protocol
Atm0/0/0 unassigned down down
Bridge-if10 unassigned down down
MFR0/0/1 unassigned down down
NULL0 unassigned up up(s)
GE0/0/1 x.x.x.x/24 up up
GE0/0/2 x.x.x.x/24 up up
【2】如果是物理接口，则在物理接口视图下执行命令tcp adjust-mss配置接口的TCP最大报文段长度，推荐数值为1200。
system-view
[Huawei] interface GigabitEthernet 0/0/1
[Huawei-GigabitEthernet0/0/1] tcp adjust-mss 1200
[Huawei] interface Dialer 0
[Huawei-Dialer0] tcp adjust-mss 1200
[Huawei-Dialer0] mtu 1492
[Huawei-Dialer0] restart
【4】建议同步将私网接口的TCP最大报文段长度值也配置成推荐值1200。假设私网接口为GE0/0/2，则在私网接口上配置tcp adjust-mss 1200命令。
system-view
[Huawei] interface GigabitEthernet 0/0/2
[Huawei-GigabitEthernet0/0/2] tcp adjust-mss 1200
私网流量大导致设备的Session资源耗尽：
背景信息
display logbuffer
Logging buffer configuration and contents: enabled
Allowed max buffer size: 1024
Actual buffer size: 512
Channel number: 4, Channel name: logbuffer
Dropped messages: 0
Overwritten messages: 167
Current messages: 512
Mar 5 2021 15:47:25+08:00 Huawei %%01FORWARD/4/SESSION-RES-LACK(l)[135]:The device session resources were overloaded.(Usage = 94%)
Mar 5 2021 16:29:25+08:00 Huawei %%01FORWARD/4/CAP-BLOCK-RES-LACK(l)[259]:The block memory resources were overloaded.(Usage = 97%)
Mar 5 2021 16:34:25+08:00 Huawei %%01FORWARD/4/SESSION-RES-LACK(l)[261]:The device session resources were overloaded.(Usage = 92%)
Mar 5 2021 16:43:25+08:00 Huawei %%01FORWARD/4/CAP-BLOCK-RES-LACK(l)[273]:The block memory resources were overloaded.(Usage = 96%)
【2】进入诊断视图，执行命令display session statistics top 10 order-by source-ip根据源IP地址统计Top 10用户的Session信息，检查Total Sessions字段的值是否接近设备的Session规格。设备的Session规格可以在规格查询工具中查到，以AR1220C为例，选择“接入路由器”->“AR1220C”->“软件性能”->“IP应用”->“NAT”->“最大并发连接数”。
[Huawei] diagnose
[Huawei-diagnose] display session statistics top 10 order-by source-ip
Session statistic top 10 (Condition: Source IP, Service: SESSION, Items: 10, Total Sessions: 25768)
-------------------------------------------------------------------------------------------------
TOP-N IP/Port Counts Percentage(%)
-------------------------------------------------------------------------------------------------
1 192.168.1.99 19714 76.505744
2 192.168.1.88 5988 23.238125
3 192.168.1.165 9 0.034927
[Huawei-diagnose] display session statistics top 10 order-by destination-port
Session statistic top 10 (Condition: Destination Port, Service: SESSION, Items: 10, Total Sessions: 25768)
-------------------------------------------------------------------------------------------------
TOP-N IP/Port Counts Percentage(%)
-------------------------------------------------------------------------------------------------
1 445 15486 60.097796
2 1433 9565 37.119683
3 3389 648 2.514747
[Huawei-diagnose] quit
[Huawei] interface GigabitEthernet 0/0/0
[Huawei-GigabitEthernet0/0/0] display this
#
ip address 192.168.1.255 255.255.255.0
在流策略里绑定ACL并将流策略应用到私网接口GE0/0/0，不允许目的端口为445和1433的流量通过私网接口，从而解决故障。
[Huawei] acl 3000
[Huawei-acl-adv-3000] rule 20 permit tcp destination-port eq 445
[Huawei-acl-adv-3000] rule 25 permit tcp destination-port eq 1433
[Huawei-acl-adv-3000] quit
[Huawei] traffic classifier virus operator or
[Huawei-classifier-virus] if-match acl 3000
[Huawei-classifier-virus] quit
[Huawei] traffic behavior virus
[Huawei-behavior-virus] deny
[Huawei-behavior-virus] quit
[Huawei] traffic policy virus
[Huawei-trafficpolicy-virus] classifier virus behavior virus
[Huawei-trafficpolicy-virus] quit
[Huawei] interface GigabitEthernet 0/0/0
[Huawei-GigabitEthernet0/0/0] traffic-policy virus outbound
[Huawei-GigabitEthernet0/0/0] traffic-policy virus inbound
私网存在ARP攻击导致用户上网时断时续：
背景信息
定位步骤
display logbuffer
Sep 9 2021 16:01:55+00:00 Huawei %%01SECE/4/PORT_ATTACK(l)[0]:Port attack occurred.(Slot=MPU, SourceAttackInterface=GigabitEthernet0/0/0, OuterVlan/InnerVlan=0/0, AttackPackets=64 packets per second)
Sep 9 2021 16:01:54+00:00 Huawei %%01DEFD/4/CPCAR_DROP_MPU(l)[1]:Some packets are dropped by cpcar on the MPU. (Packet-type=arp-miss, Drop-Count=770)
Sep 9 2021 16:01:54+00:00 Huawei %%01DEFD/4/CPCAR_DROP_MPU(l)[2]:Some packets are dropped by cpcar on the MPU. (Packet-type=arp-request, Drop-Count=3458)
【2】如果日志中有ARP报文被丢弃，则怀疑设备连接的私网中存在ARP攻击。此时，可以在设备上配置攻击溯源功能，进一步排查。
system-view
[Huawei] cpu-defend policy 1
[Huawei-cpu-defend-policy-1] auto-defend enable
[Huawei-cpu-defend-policy-1] auto-defend threshold 40 //可适当调整建议不要太小
[Huawei-cpu-defend-policy-1] auto-defend attack-packet sample 5
[Huawei-cpu-defend-policy-1] auto-defend protocol all
[Huawei-cpu-defend-policy-1] auto-defend trace-type source-ip source-mac source-portvlan
[Huawei-cpu-defend-policy-1] auto-defend alarm enable
[Huawei-cpu-defend-policy-1] quit
[Huawei] cpu-defend-policy 1
[Huawei] cpu-defend-policy 1 global
【3】配置完攻击溯源后，当网络出现异常时，在设备上执行命令display auto-defend attack-source进一步确认是否存在ARP攻击。
[Huawei] display auto-defend attack-source
Attack Source User Table:
-------------------------------------------------------------------------
MacAddress InterfaceName Vlan:Outer/Inner TOTAL
-------------------------------------------------------------------------
xxxx-xxxx-xxxx GigabitEthernet0/0/1 0 368
yyyy-yyyy-yyyy GigabitEthernet0/0/0 0 7152
-------------------------------------------------------------------------
Total: 2Attack Source Port Table:
—————————————————–
InterfaceName Vlan:Outer/Inner TOTAL
—————————————————–
GigabitEthernet0/0/1 0 368
GigabitEthernet0/0/0 0 23472
—————————————————–
Total: 2
Attack Source IP Table:
————————————-
IPAddress TOTAL Packets
————————————-
x.x.x.x 368
y.y.y.y 7152
————————————-
Total: 2
[Huawei] acl number 4444
[Huawei-acl-L2-4444] rule 5 deny l2-protocol arp source-mac yyyy-yyyy-yyyy
[Huawei] interface gigabitethernet 0/0/0
[Huawei-GigabitEthernet0/0/0] traffic-filter inbound acl 4444
[Huawei-GigabitEthernet0/0/0] quit
[Huawei] quit
公网接口状态异常导致网速慢
背景信息
【1】假设AR设备连接公网的接口为GE0/0/1，执行命令display interface查看公网接口的信息，关注Duplex、Total Error、CRC、Giants等加粗部分的参数值。
display interface GigabitEthernet 0/0/1
GigabitEthernet0/0/1 current state : UP
Line protocol current state : UP
Last line protocol up time : 2021-10-08 09:00:00
Description:HUAWEI, AR Series, GigabitEthernet0/0/1 Interface
Route Port,The Maximum Transmit Unit is 1500
Internet Address is 120.44.5.15/24
IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 60d7-55f0-42c1
Last physical up time : 2021-10-08 09:00:00
Last physical down time : 2021-10-08 08:58:09
Current system time: 2021-10-22 06:14:56
Port Mode: COMMON COPPER
Speed : 100, Loopback: NONE
Duplex: FULL, Negotiation: ENABLE
Mdi : AUTO, Clock : -
Last 300 seconds input rate 99992 bits/sec, 50 packets/sec
Last 300 seconds output rate 192 bits/sec, 0 packets/sec
Input peak rate 223880 bits/sec,Record time: 2021-10-13 14:13:56
Output peak rate 18464 bits/sec,Record time: 2021-10-20 07:27:05 Input: 55586497 packets, 13516267464 bytes
Unicast: 10526, Multicast: 195548
Broadcast: 55380423, Jumbo: –
Discard: 0, Total Error: 0
CRC: 0, Giants: 0
Jabbers: 0, Throttles: 0
Runts: 0, Symbols: 0
Ignoreds: 0, Frames: 0
Output: 9237 packets, 590811 bytes
Unicast: 9227, Multicast: 0
Broadcast: 10, Jumbo: –
Discard: 0, Total Error: 0
Collisions: 0, ExcessiveCollisions: 0
Late Collisions: 0, Deferreds: 0
Input bandwidth utilization threshold : 100.00%
Output bandwidth utilization threshold: 100.00%
Input bandwidth utilization : 0.11%
Output bandwidth utilization : 0.01%
system-view
[Huawei] interface GigabitEthernet 0/0/1
[Huawei-GigabitEthernet0/0/1] undo negotiation auto
[Huawei-GigabitEthernet0/0/1] speed 100
system-view
[Huawei] interface GigabitEthernet 0/0/1
[Huawei-GigabitEthernet0/0/1] duplex full
[Huawei-GigabitEthernet0/0/1] quit
[Huawei] quit
Dialer接口拨号失败后路由未失效
背景信息
display ip interface brief
*down: administratively down
^down: standby
(l): loopback
(s): spoofing
(E): E-Trunk down
The number of interface that is UP in Physical is 2
The number of interface that is DOWN in Physical is 3
The number of interface that is UP in Protocol is 2
The number of interface that is DOWN in Protocol is 3 Interface IP Address/Mask Physical Protocol
Dialer1 unassigned up up(s)
Dialer2 100.64.40.165/32 up up(s)
【2】执行命令display ip routing-table查看IPv4路由表的信息。
display ip routing-table
Route Flags: R - relay, D - download to fib, T - to vpn-instance
------------------------------------------------------------------------------
Routing Tables: Public
Destinations : 31 Routes : 32 Destination/Mask Proto Pre Cost Flags NextHop Interface
0.0.0.0/0 Static 60 0 D 0.0.0.0 Dialer1
Static 60 0 D 100.64.40.165 Dialer2
<Huawei> system-view
[Huawei] interface dialer 1
[Huawei-Dialer1] dialer number 1 autodial
[Huawei-Dialer1] quit
[Huawei] quit
公网口上收到的报文来回路径不一致
system-view
[Huawei] acl 3000
[Huawei-acl-adv-3000] rule 5 permit tcp source 172.168.1.254 0.0.0.0 source-port eq 65532
[Huawei-acl-adv-3000] quit
[Huawei] interface GigabitEthernet 0/0/2
[Huawei-GigabitEthernet0/0/2] traffic-filter inbound acl 3000
[Huawei-GigabitEthernet0/0/2] quit
【2】在GE0/0/2上配置完流量统计功能后，执行命令display acl all查看设备上是否有ACL匹配计数。如果有如下粗体部分的记录，说明GE2口上收到了GE1口发出去的报文，出现了报文来回路径不一致的情况，需要联系对端网络工程师处理。
[Huawei] display acl all
Total quantity of nonempty ACL number is 1 Advanced ACL 3000, 1 rule
Acl‘s step is 5
rule 5 permit tcp source 172.168.1.254 0 source-port eq 65532 (2 matches)
负载分担场景下的用户上网慢
背景信息
display ip routing-table protocol static
Route Flags: R - relay, D - download to fib, T - to vpn-instance
------------------------------------------------------------------------------
Public routing table : Static
Destinations : 1 Routes : 2 Configured Routes : 2 Static routing table status :
Destinations : 0 Routes : 0
Static routing table status :
Destinations : 1 Routes : 2
Destination/Mask Proto Pre Cost Flags NextHop Interface
0.0.0.0/0 Static 60 0 172.16.1.2 Unknown
0.0.0.0/0 Static 60 0 10.1.1.2 Unknown
【2】删掉其中一条路由，重新访问网页，检查使用单链路上网时是否会出现上网慢现象。如果无，则说明两条链路质量都很好，上网慢并非是等价路由引起的问题，有可能是负载分担算法配置不合理引起的。此时，可以执行命令ip load-balance hash，配置两条等价路由的负载分担方式。缺省情况下，IP报文基于源IP地址和目的IP地址进行负载分担；TCP或者UDP报文基于源IP地址、目的IP地址、源端口号和目的端口号进行负载分担。
system-view
[Huawei] ip load-balance hash src-ip //配置基于源IP地址进行负载分担
[Router] ip route-static 0.0.0.0 0 10.1.1.2 preference 100
【4】如果用户不想把两条链路改成主备备份，仍然希望两条链路都能转发流量，也可以通过配置策略路由的方式解决该问题。策略路由配置的原则为让质量好的链路多转发一些流量，质量差的链路少转发一些流量。例如，让70%的用户流量从质量好的链路转发，30%的用户流量从质量差的链路转发。
主备链路场景下的用户上网慢
背景信息
【1】在AR路由器上连续多次执行命令display nat session查看NAT映射表项信息是否有变化。
<Huawei> display nat session all verbose
NAT Session Table Information:Protocol : TCP(6)
SrcAddr Port Vpn : 10.200.200.200 65532
DestAddr Port Vpn : 10.100.100.100 1024
Time To Live : 60 s
NAT-Info
New SrcAddr : 10.10.10.10
New SrcPort : 10240
New DestAddr : 10.30.30.30
New DestPort : 21
Protocol : UDP(6)
SrcAddr Port Vpn : 10.200.200.200 65532
DestAddr Port Vpn : 10.100.100.100 1024
Time To Live : 60 s
NAT-Info
New SrcAddr : 10.10.10.10
New SrcPort : 10240
New DestAddr : 10.30.30.3
New DestPort : 21
Total : 2
【1】收集故障相关信息
display diagnostic-information dia-info.txt
This operation will take several minutes, please wait.........................
..................................................................
Info: The diagnostic information was saved to the device successfully.
save logfile
Info: It may take several seconds,please wait...
Save log file successfully.