#!/bin/bash
# dns_diagnostic.sh — 多源 DNS 健康检测

DOMAIN="${1:-example.com}"
DNS_SERVERS=("8.8.8.8" "1.1.1.1" "223.5.5.5" "9.9.9.9" "119.29.29.29")

echo "=== DNS 多源解析诊断: $DOMAIN ==="
echo ""

results=()
for dns in "${DNS_SERVERS[@]}"; do
    result=$(dig @"$dns" "$DOMAIN" +short +time=5 +tries=2 2>/dev/null)
    status=$?
    if [ $status -eq 0 ] && [ -n "$result" ]; then
        echo "  [$dns] → $result"
        results+=("$result")
    else
        echo "  [$dns] ❌ 解析失败或超时"
    fi
done

# 一致性检查
unique_ips=$(printf '%s\n' "${results[@]}" | sort -u | wc -l)
total_resolutions=${#results[@]}

echo ""
if [ $unique_ips -eq 1 ]; then
    echo "✅ DNS 一致性: 所有 DNS 服务器返回相同结果"
elif [ $unique_ips -le 3 ]; then
    echo "⚠️  DNS 轻微分歧: 检测到 $unique_ips 种不同解析结果，可能存在 GSLB 或 CDN 调度"
else
    echo "🚨 DNS 严重分歧: 检测到 $unique_ips 种不同结果，可能存在 DNS 污染或配置错误"
fi

# TTL 检查
echo ""
echo "--- TTL 分析 ---"
for dns in "${DNS_SERVERS[@]:0:2}"; do
    ttl=$(dig @"$dns" "$DOMAIN" +noall +answer | awk '/^[^;]/ {print $5}' | head -1)
    echo "  [$dns] TTL = ${ttl}s"
done

# dns_ai_analyzer.py
import json
from openai import OpenAI  # 或 ollama 兼容接口

def analyze_dns_issues(dns_data: dict, history: list) -> dict:
    """AI 驱动的 DNS 问题根因分析"""
    
    client = OpenAI(base_url="http://localhost:11434/v1", api_key="ollama")
    
    prompt = f"""你是一个专业的网络运维专家。请分析以下 DNS 诊断数据，找出潜在问题并给出修复建议。

【当前诊断结果】
{json.dumps(dns_data, ensure_ascii=False, indent=2)}

【历史故障记录】
{json.dumps(history[-10:], ensure_ascii=False, indent=2) if history else '无历史记录'}

请按以下格式输出 JSON：
{{
  "issues": [
    {{
      "severity": "critical|warning|info",
      "type": "dns_poisoning|ttl_anomaly|resolution_failure|inconsistency|cache_expiry",
      "description": "问题描述",
      "affected_domains": ["domain1"],
      "evidence": "关键证据"
    }}
  ],
  "root_cause": "最可能的根因",
  "recommendations": [
    {{
      "action": "具体修复操作",
      "command": "执行的命令（如有）",
      "priority": 1
    }}
  ],
  "confidence": 0.95
}}"""

    response = client.chat.completions.create(
        model="qwen2.5:7b",
        messages=[{"role": "user", "content": prompt}],
        response_format={"type": "json_object"},
        temperature=0.1
    )
    
    return json.loads(response.choices[0].message.content)

# tcp_monitor.py
import subprocess
import re
import json
from datetime import datetime, timedelta
from collections import deque

class TCPQualityMonitor:
    """TCP 连接质量监控"""
    
    def __init__(self, sample_interval=5):
        self.sample_interval = sample_interval
        self.metrics_history = deque(maxlen=288)  # 24小时 @ 5分钟间隔
    
    def get_tcp_stats(self) -> dict:
        """采集当前 TCP 连接统计"""
        stats = {}
        
        # 活跃连接数
        result = subprocess.run(
            ['ss', '-s'], capture_output=True, text=True
        )
        active = re.search(r'estab (\d+)', result.stdout)
        stats['established'] = int(active.group(1)) if active else 0
        
        # 重传率
        result = subprocess.run(
            ['ss', '-i'], capture_output=True, text=True
        )
        retransmits = re.findall(r'retransmits (\d+)', result.stdout)
        stats['total_retransmits'] = sum(int(r) for r in retransmits)
        
        # RTT 统计
        result = subprocess.run(
            ['ss', '-tni'], capture_output=True, text=True
        )
        rtts = re.findall(r'rto (\d+) ato (\d+)', result.stdout)
        if rtts:
            rto_values = [int(r[0]) for r in rtts]
            stats['avg_rto'] = sum(rto_values) / len(rto_values)
            stats['max_rto'] = max(rto_values)
        
        # 窗口大小
        windows = re.findall(r'wc:(\d+)', result.stdout)
        if windows:
            w_values = [int(w) for w in windows]
            stats['avg_window'] = sum(w_values) / len(w_values)
            stats['min_window'] = min(w_values)
        
        stats['timestamp'] = datetime.now().isoformat()
        return stats
    
    def detect_anomalies(self, current: dict, baseline: dict) -> list:
        """基于历史基线检测异常"""
        anomalies = []
        
        # 重传率异常
        if baseline.get('retransmit_rate', 0) > 0:
            current_retransmit = current.get('total_retransmits', 0) / max(current['established'], 1)
            baseline_rate = baseline.get('retransmit_rate', 0)
            if current_retransmit > baseline_rate * 3:
                anomalies.append({
                    'type': 'high_retransmit',
                    'current': round(current_retransmit, 4),
                    'baseline': round(baseline_rate, 4),
                    'severity': 'warning'
                })
        
        # 窗口收缩异常
        if current.get('min_window', 0) < 1460:
            anomalies.append({
                'type': 'window_shrink',
                'value': current['min_window'],
                'severity': 'info'
            })
        
        return anomalies
    
    def get_tcp_state_distribution(self) -> dict:
        """获取 TCP 连接状态分布"""
        result = subprocess.run(
            ['ss', '-tan'], capture_output=True, text=True
        )
        states = re.findall(r'\w+(?=\s)', result.stdout)
        distribution = {}
        for state in states:
            distribution[state] = distribution.get(state, 0) + 1
        return distribution

# tcp_ai_analyzer.py
def analyze_tcp_issues(tcp_metrics: dict, tcp_history: list) -> dict:
    """AI 分析 TCP 质量问题"""
    
    prompt = f"""你是网络专家。分析以下 TCP 质量数据，诊断潜在问题。

【当前 TCP 指标】
- 活跃连接数: {tcp_metrics.get('established', 0)}
- 平均 RTT: {tcp_metrics.get('avg_rtt_ms', 'N/A')}ms
- 最大 RTO: {tcp_metrics.get('max_rto', 0)}ms
- 最小窗口: {tcp_metrics.get('min_window', 0)} bytes
- 重传次数: {tcp_metrics.get('total_retransmits', 0)}
- 连接状态分布: {json.dumps(tcp_metrics.get('state_distribution', {}))}

【近期趋势】
{json.dumps(tcp_history[-20:], ensure_ascii=False) if tcp_history else '数据不足'}

请输出 JSON 格式的分析和修复建议。"""

    # 调用 LLM 进行分析...
    # (同 DNS 分析的 LLM 调用模式)
    pass

#!/bin/bash
# latency_diagnostic.sh — AI 增强延迟诊断

TARGET="${1:-8.8.8.8}"
echo "=== 延迟诊断: $TARGET ==="
echo ""

# 1. 基础连通性
echo "--- ICMP 延迟 (10次) ---"
ping -c 10 "$TARGET" 2>/dev/null | grep -E 'rtt|packet'
echo ""

# 2. 路由追踪
echo "--- 路由追踪 ---"
mtr -r -c 5 --no-dns "$TARGET" 2>/dev/null | tail -20
echo ""

# 3. TCP 连接延迟
echo "--- TCP 握手延迟 ---"
for i in $(seq 1 5); do
    start=$(date +%s%N)
    curl -s -o /dev/null -w "%{time_connect}" "https://$TARGET" 2>/dev/null
    end=$(date +%s%N)
done
echo ""

# 4. 带宽测试
echo "--- 带宽测试 ---"
if command -v iperf3 &>/dev/null; then
    iperf3 -c "$TARGET" -t 5 --format b 2>&1 | grep -E 'sender|receiver|sent'
else
    echo "(iperf3 未安装，跳过带宽测试)"
fi
echo ""

# 5. 丢包率统计
echo "--- 丢包率 (30秒) ---"
fping -q -c 30 -i 100 "$TARGET" 2>/dev/null | tail -1

# latency_ai_report.py
import subprocess
import json

def generate_latency_report(diagnostic_output: str) -> dict:
    """AI 生成延迟分析报告"""
    
    prompt = f"""你是网络性能专家。根据以下延迟诊断结果，生成详细的分析报告。

【诊断原始输出】
{diagnostic_output}

请输出 JSON:
{{
  "bottleneck_location": "wan|edge|vps_inbound|protocol|application",
  "bottleneck_description": "瓶颈描述",
  "latency_breakdown": {{
    "dns_resolution_ms": 15,
    "tcp_handshake_ms": 25,
    "tls_negotiation_ms": 30,
    "server_processing_ms": 50,
    "total_ms": 120
  }},
  "recommendations": [
    {{
      "category": "network|protocol|application",
      "action": "具体措施",
      "expected_improvement": "预期改善"
    }}
  ],
  "priority": "high|medium|low"
}}"""
    
    # 调用 LLM 生成报告...
    pass

# bgp_monitor.py
import subprocess
import json
from datetime import datetime

class BGPMonitor:
    """BGP 路由监控"""
    
    def __init__(self):
        self.last_routes = {}
        self.events = []
    
    def get_bgp_routes(self) -> dict:
        """获取当前 BGP 路由表"""
        routes = {}
        
        # 通过 birdcli 获取 BGP 路由
        result = subprocess.run(
            ['birdcli', 'bird', 'show', 'route'],
            capture_output=True, text=True
        )
        
        # 解析路由输出...
        # 简化版：直接保存原始输出
        routes['raw'] = result.stdout
        routes['timestamp'] = datetime.now().isoformat()
        
        return routes
    
    def detect_changes(self, current: dict, previous: dict) -> list:
        """检测路由变化"""
        changes = []
        
        current_routes = set(current.get('raw', '').split())
        previous_routes = set(previous.get('raw', '').split())
        
        new_routes = current_routes - previous_routes
        lost_routes = previous_routes - current_routes
        
        if new_routes:
            changes.append({
                'type': 'route_added',
                'routes': list(new_routes)[:10],
                'timestamp': datetime.now().isoformat()
            })
        
        if lost_routes:
            changes.append({
                'type': 'route_lost',
                'routes': list(lost_routes)[:10],
                'timestamp': datetime.now().isoformat(),
                'severity': 'critical'
            })
        
        return changes
    
    def check_route_stability(self, history: list) -> dict:
        """分析路由稳定性"""
        if len(history) < 2:
            return {'status': 'insufficient_data'}
        
        total_changes = 0
        critical_events = 0
        
        for entry in history:
            if 'changes' in entry:
                for change in entry['changes']:
                    total_changes += 1
                    if change.get('severity') == 'critical':
                        critical_events += 1
        
        return {
            'total_route_changes': total_changes,
            'critical_events': critical_events,
            'stability_score': max(0, 100 - total_changes * 5 - critical_events * 20),
            'status': 'stable' if critical_events == 0 else 'unstable'
        }

# bgp_ai_analyzer.py
def analyze_bgp_anomalies(route_changes: list, stability: dict) -> dict:
    """AI 分析 BGP 路由异常"""
    
    prompt = f"""你是 BGP 路由专家。分析以下路由变化事件。

【路由变化事件】
{json.dumps(route_changes, ensure_ascii=False, indent=2)}

【稳定性评分】
{json.dumps(stability, ensure_ascii=False)}

请输出 JSON 分析结果，包括：
- 异常类型判定
- 可能的根因（路由泄漏/黑洞/AS 路径变化）
- 影响评估
- 修复建议"""
    
    # 调用 LLM...
    pass

# intermittent_fault_detector.py
import numpy as np
from datetime import datetime, timedelta

class IntermittentFaultDetector:
    """间歇性故障检测器"""
    
    def __init__(self, window_size=60):
        self.window_size = window_size  # 滑动窗口大小（秒）
        self.packet_logs = []
    
    def add_packet_sample(self, timestamp: datetime, sent: int, received: int):
        """添加丢包样本"""
        self.packet_logs.append({
            'timestamp': timestamp.isoformat(),
            'sent': sent,
            'received': received,
            'loss_rate': (sent - received) / sent if sent > 0 else 0
        })
    
    def detect_burst_loss(self, window_seconds=30) -> list:
        """检测突发丢包"""
        if len(self.packet_logs) < self.window_size:
            return []
        
        recent = self.packet_logs[-self.window_size:]
        loss_rates = [p['loss_rate'] for p in recent]
        
        # 计算基线和异常
        mean_loss = np.mean(loss_rates)
        std_loss = np.std(loss_rates)
        
        bursts = []
        for i, rate in enumerate(loss_rates):
            if rate > mean_loss + 2 * std_loss and rate > 0.01:  # 超过 2σ 且丢包率 > 1%
                bursts.append({
                    'index': i,
                    'loss_rate': round(rate, 4),
                    'timestamp': recent[i]['timestamp'],
                    'severity': 'high' if rate > 0.05 else 'medium'
                })
        
        return bursts
    
    def detect_periodic_loss(self) -> dict:
        """检测周期性丢包模式"""
        if len(self.packet_logs) < 120:  # 需要至少 10 分钟数据
            return {'detected': False}
        
        loss_rates = [p['loss_rate'] for p in self.packet_logs]
        
        # 简单的周期性检测：检查是否存在固定间隔的高丢包
        thresholds = [0.05, 0.1, 0.2]
        results = {}
        
        for threshold in thresholds:
            high_loss_indices = [i for i, r in enumerate(loss_rates) if r >= threshold]
            if len(high_loss_indices) >= 3:
                intervals = [high_loss_indices[i+1] - high_loss_indices[i] 
                            for i in range(len(high_loss_indices)-1)]
                if intervals:
                    avg_interval = np.mean(intervals)
                    if 5 < avg_interval < 120:  # 合理的周期范围
                        results[f'loss_ge_{threshold:.0%}'] = {
                            'detected': True,
                            'avg_interval_samples': round(avg_interval, 1),
                            'occurrence_count': len(high_loss_indices)
                        }
        
        return results
    
    def generate_fault_report(self) -> dict:
        """生成故障报告"""
        bursts = self.detect_burst_loss()
        periodic = self.detect_periodic_loss()
        
        return {
            'sample_count': len(self.packet_logs),
            'burst_losses': bursts[-5:],  # 最近 5 次
            'periodic_patterns': periodic,
            'overall_loss_rate': round(
                np.mean([p['loss_rate'] for p in self.packet_logs[-self.window_size:]]), 4
            ) if self.packet_logs else 0,
            'recommendation': self._get_recommendation(bursts, periodic)
        }
    
    def _get_recommendation(self, bursts, periodic) -> str:
        if periodic.get('loss_ge_5%', {}).get('detected'):
            return "检测到周期性丢包，可能是 QoS 策略、带宽限速或网络设备轮询导致。建议检查流量整形配置。"
        elif len(bursts) > 3:
            return "检测到多次突发丢包，可能是网络拥塞或链路不稳定。建议联系 ISP 排查物理链路质量。"
        elif self.overall_loss_rate > 0.01:
            return "存在持续低级别丢包，建议启用 TCP 快速重传和优化 MTU 设置。"
        return "丢包率在正常范围内，无需干预。"

# fault_pattern_recognition.py
def recognize_fault_pattern(fault_data: dict) -> dict:
    """AI 识别故障模式"""
    
    prompt = f"""你是网络故障诊断专家。根据以下故障数据，识别故障模式并给出诊断。

【丢包统计】
- 总体丢包率: {fault_data.get('overall_loss_rate', 0):.2%}
- 突发丢包次数: {len(fault_data.get('burst_losses', []))}
- 周期性模式: {json.dumps(fault_data.get('periodic_patterns', {}))}

【网络上下文】
- 最近变更: ["DNS 服务器切换", "内核升级", "安全组规则更新"]
- 关联告警: ["CPU 使用率升高", "内存压力"]

请输出 JSON:
{{
  "pattern_type": "qos_throttling|congestion|link_instability|dns_pollution|firewall_intervention",
  "confidence": 0.85,
  "analysis": "详细分析",
  "next_steps": ["步骤1", "步骤2"]
}}"""
    
    # 调用 LLM...
    pass

# auto_remediation.py
from enum import Enum
import subprocess
import json

class RemediationAction(Enum):
    DNS_SWITCH = "dns_switch"           # 切换 DNS
    FLUSH_CACHE = "flush_cache"         # 清空缓存
    TCP_TUNING = "tcp_tuning"           # TCP 参数调优
    BBR_ENABLE = "bbr_enable"           # 启用 BBR 拥塞控制
    MTU_ADJUST = "mtu_adjust"           # MTU 调整
    ROUTE_FIX = "route_fix"             # 路由修复
    FIREWALL_RULE = "firewall_rule"     # 防火墙规则修正
    SERVICE_RESTART = "service_restart" # 重启服务

class AutoRemediationEngine:
    """自动修复引擎"""
    
    def __init__(self):
        self.action_log = []
    
    def execute_remediation(self, diagnosis: dict) -> dict:
        """根据诊断结果执行自动修复"""
        results = []
        
        for issue in diagnosis.get('issues', []):
            action = self._match_action(issue)
            if action:
                result = self._run_action(action, issue)
                results.append(result)
        
        return {
            'remediation_results': results,
            'success_count': sum(1 for r in results if r['success']),
            'failed_count': sum(1 for r in results if not r['success'])
        }
    
    def _match_action(self, issue: dict) -> RemediationAction | None:
        """将问题映射到修复动作"""
        issue_type = issue.get('type', '')
        
        mappings = {
            'dns_failure': RemediationAction.DNS_SWITCH,
            'dns_poisoning': RemediationAction.DNS_SWITCH,
            'high_retransmit': RemediationAction.BBR_ENABLE,
            'tcp_congestion': RemediationAction.TCP_TUNING,
            'mtu_mismatch': RemediationAction.MTU_ADJUST,
            'route_lost': RemediationAction.ROUTE_FIX,
            'firewall_block': RemediationAction.FIREWALL_RULE,
        }
        
        return mappings.get(issue_type)
    
    def _run_action(self, action: RemediationAction, issue: dict) -> dict:
        """执行修复动作"""
        result = {'action': action.value, 'success': False, 'output': ''}
        
        try:
            if action == RemediationAction.DNS_SWITCH:
                output = self._switch_dns(issue)
                result['success'] = 'nameserver' in output.lower() or 'success' in output.lower()
            
            elif action == RemediationAction.BBR_ENABLE:
                output = self._enable_bbr()
                result['success'] = 'bbr' in output
            
            elif action == RemediationAction.TCP_TUNING:
                output = self._tune_tcp()
                result['success'] = True
            
            elif action == RemediationAction.MTU_ADJUST:
                output = self._adjust_mtu(issue)
                result['success'] = True
            
            result['output'] = output
            
        except Exception as e:
            result['error'] = str(e)
        
        self.action_log.append({
            'action': action.value,
            'timestamp': __import__('datetime').datetime.now().isoformat(),
            'success': result['success']
        })
        
        return result
    
    def _switch_dns(self, issue: dict) -> str:
        """切换到备用 DNS"""
        # 实际场景中应读取配置的 DNS 备选列表
        commands = [
            'echo "nameserver 1.1.1.1" > /tmp/resolv.conf.new',
            'echo "nameserver 8.8.8.8" >> /tmp/resolv.conf.new',
            'cp /etc/resolv.conf /etc/resolv.conf.bak',
            'cp /tmp/resolv.conf.new /etc/resolv.conf',
            'systemctl restart systemd-resolved 2>/dev/null || systemctl restart networking 2>/dev/null'
        ]
        outputs = []
        for cmd in commands:
            r = subprocess.run(cmd, shell=True, capture_output=True, text=True)
            outputs.append(r.stdout + r.stderr)
        return '\n'.join(outputs)
    
    def _enable_bbr(self) -> str:
        """启用 BBR 拥塞控制"""
        cmd = 'sysctl -w net.ipv4.tcp_congestion_control=bbr && modprobe tcp_bbr'
        return subprocess.run(cmd, shell=True, capture_output=True, text=True).stdout
    
    def _tune_tcp(self) -> str:
        """TCP 参数调优"""
        cmds = [
            'sysctl -w net.ipv4.tcp_tw_reuse=1',
            'sysctl -w net.ipv4.tcp_max_syn_backlog=4096',
            'sysctl -w net.core.somaxconn=4096',
            'sysctl -w net.ipv4.tcp_rmem="4096 87380 16777216"',
            'sysctl -w net.ipv4.tcp_wmem="4096 65536 16777216"'
        ]
        outputs = []
        for cmd in cmds:
            r = subprocess.run(cmd, shell=True, capture_output=True, text=True)
            outputs.append(r.stdout.strip())
        return '\n'.join(outputs)
    
    def _adjust_mtu(self, issue: dict) -> str:
        """MTU 调整"""
        # 智能 MTU 探测
        target = issue.get('mtu_target', 1460)
        cmd = f'ip link set dev eth0 mtu {target}'
        return subprocess.run(cmd, shell=True, capture_output=True, text=True).stdout
    
    def verify_remediation(self, original_diagnosis: dict) -> dict:
        """验证修复效果"""
        # 重新采集指标，对比修复前后
        # 简化示例：
        return {
            'verified': True,
            'before': original_diagnosis.get('metrics', {}),
            'after': {},  # 重新采集的结果
            'improvement': '指标已恢复正常'
        }

# remediation_verifier.py
def verify_and_rollback(diagnosis: dict, remediation_result: dict, 
                        pre_fix_baseline: dict) -> dict:
    """验证修复效果，必要时回滚"""
    
    # 重新采集指标
    post_fix_metrics = collect_network_metrics()
    
    # 对比分析
    improvements = {}
    for metric in ['retransmit_rate', 'avg_rtt', 'packet_loss_rate']:
        before = pre_fix_baseline.get(metric, 0)
        after = post_fix_metrics.get(metric, 0)
        if before > 0:
            change = (before - after) / before * 100
            improvements[metric] = round(change, 2)
    
    # 判断是否需要回滚
    needs_rollback = any(v < -10 for v in improvements.values())  # 任何指标恶化超过 10%
    
    if needs_rollback:
        rollback_result = execute_rollback(diagnosis)
        return {
            'status': 'rolled_back',
            'reason': '修复后指标恶化',
            'rollback_output': rollback_result
        }
    
    return {
        'status': 'success',
        'improvements': improvements,
        'auto_rollback_triggered': False
    }

# docker-compose.yml
version: '3.8'

services:
  network-diagnostic-agent:
    image: selfvps/network-diag:latest
    container_name: vps-network-diag
    privileged: true
    volumes:
      - ./config:/app/config
      - ./logs:/app/logs
      - ./data:/app/data
    environment:
      - LLM_ENDPOINT=http://ollama:11434
      - LLM_MODEL=qwen2.5:7b
      - ALERT_CHANNEL=telegram
      - TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN}
      - TELEGRAM_CHAT_ID=${TELEGRAM_CHAT_ID}
    restart: unless-stopped
    networks:
      - diag-network

  ollama:
    image: ollama/ollama:latest
    container_name: vps-ollama
    volumes:
      - ollama_data:/root/.ollama
    ports:
      - "11434:11434"
    restart: unless-stopped
    networks:
      - diag-network

  # 可选：时序数据库用于长期存储
  timescaledb:
    image: timescale/timescaledb:latest-pg15
    container_name: vps-timescaledb
    environment:
      - POSTGRES_PASSWORD=${DB_PASSWORD}
    volumes:
      - tsdata:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    restart: unless-stopped
    networks:
      - diag-network

volumes:
  ollama_data:
  tsdata:

networks:
  diag-network:
    driver: bridge

# cron 配置：每 5 分钟执行一次轻量诊断，每小时执行一次深度诊断
*/5 * * * * /opt/network-diag/diagnostic.sh --quick >> /var/log/vps-net-diag.log 2>&1
0 * * * * /opt/network-diag/diagnostic.sh --full >> /var/log/vps-net-diag.log 2>&1

# alert_config.py
ALERT_RULES = {
    'dns_failure': {
        'condition': 'dns_resolution_failures > 3 in 5min',
        'severity': 'critical',
        'channels': ['telegram', 'email'],
        'auto_remediate': True
    },
    'high_retransmit': {
        'condition': 'tcp_retransmit_rate > 5% for 10min',
        'severity': 'warning',
        'channels': ['telegram'],
        'auto_remediate': True
    },
    'route_instability': {
        'condition': 'bgp_route_changes > 5 in 10min',
        'severity': 'critical',
        'channels': ['telegram', 'sms'],
        'auto_remediate': False  # BGP 变更需人工确认
    },
    'intermittent_loss': {
        'condition': 'packet_loss_rate > 1% with periodic pattern',
        'severity': 'warning',
        'channels': ['telegram'],
        'auto_remediate': True
    }
}

{
  "root_cause": "ISP 路径拥塞导致 TCP 窗口收缩 + DNS 解析分歧",
  "recommendations": [
    {
      "priority": 1,
      "action": "启用 BBR 拥塞控制算法",
      "command": "sysctl -w net.ipv4.tcp_congestion_control=bbr",
      "expected_improvement": "预计降低 RTT 30-50%, 减少重传"
    },
    {
      "priority": 2,
      "action": "切换 DNS 上游至 1.1.1.1",
      "command": "echo 'nameserver 1.1.1.1' > /etc/resolv.conf",
      "expected_improvement": "消除 DNS 解析分歧"
    }
  ],
  "confidence": 0.92
}