Menu
Reference list of signals that look suspicious but are normal testbed behavior. Consult before promoting any observation to a symptom.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Integration-test skill only. Invoke at the start of every troubleshooting session before other diagnostics to confirm the NIKA skill library is loaded.
Identify ACL and firewall faults from nftables or iptables rules. Use when traffic is selectively blocked by protocol or service (ARP, ICMP, HTTP, DNS, BGP, or packet-size filtering).
Identify BGP routing faults — ASN misconfiguration, missing route advertisement, prefix hijacking, blackhole route leak. Use when reachability failures follow BGP-routed paths, BGP sessions fail to establish, or expected prefixes are missing from peers.
Parse oversized MCP tool output. When a tool returns "Output has been saved to <file>.txt" because the result exceeded Claude Code's token limit, run this skill's parser instead of re-reading the file in chunks. Covers `get_reachability` on large topologies and `service_snapshot` on labs with many published hostnames.
Identify DHCP server-side faults — service down, missing subnet declaration, spoofed gateway or DNS pushed by the server. Use when one or more hosts cannot obtain a lease, or hosts received DHCP-supplied values that look wrong.
Broad-search escalation toolbox. Enter when the blind start surfaces no symptom. Run phases in order, and exit the moment a helper surfaces an anomaly.
| name | baseline-behavior-skill |
| description | Reference list of signals that look suspicious but are normal testbed behavior. Consult before promoting any observation to a symptom. |
status=unknown rows. Intermittent faults need either repeated probes over time or direct evidence on the device./proc/loadavg can be host-shared, not container-local, because Kathara containers share the host kernel.dmesg is shared host kernel output. Do not use it as per-container evidence.frr_show_running_config and frr_show_ip_route can look healthy even if FRR is dead; check the daemon processes directly.router_name.exec_shell(host_name="<router>", command="vtysh -c '...'").