nika

Integration-test skill only. Invoke at the start of every troubleshooting session before other diagnostics to confirm the NIKA skill library is loaded.

Identify ACL and firewall faults from nftables or iptables rules. Use when traffic is selectively blocked by protocol or service (ARP, ICMP, HTTP, DNS, BGP, or packet-size filtering).

Reference list of signals that look suspicious but are normal testbed behavior. Consult before promoting any observation to a symptom.

Identify BGP routing faults — ASN misconfiguration, missing route advertisement, prefix hijacking, blackhole route leak. Use when reachability failures follow BGP-routed paths, BGP sessions fail to establish, or expected prefixes are missing from peers.

Parse oversized MCP tool output. When a tool returns "Output has been saved to <file>.txt" because the result exceeded Claude Code's token limit, run this skill's parser instead of re-reading the file in chunks. Covers `get_reachability` on large topologies and `service_snapshot` on labs with many published hostnames.

Identify DHCP server-side faults — service down, missing subnet declaration, spoofed gateway or DNS pushed by the server. Use when one or more hosts cannot obtain a lease, or hosts received DHCP-supplied values that look wrong.

Broad-search escalation toolbox. Enter when the blind start surfaces no symptom. Run phases in order, and exit the moment a helper surfaces an anomaly.

Identify DNS server-side faults — wrong record, daemon down, port 53 filtered, or injected lookup latency. Use when hostname-based access fails or is slow while direct-IP access to the same target works.

Identify a device that has been killed, stopped, or removed from the topology. Use when a device is completely unresponsive — ICMP fails, shell never opens, no service response — while same-role peers stay clean.

Identify per-host L2/L3 identity faults — IP conflict, wrong IP, wrong gateway, wrong netmask, missing IP, host-local resolv.conf misconfig, static `arp -s` poisoning. Use when one host (or a small minority) shows an addressing anomaly its same-subnet peers do not share.

Identify link_flap, link_down, and link_detach faults. Use when an interface is DOWN, missing, detached, repeatedly flapping, or shows network-down history.

Identify load-balancer-side service faults. Use when the topology includes a load balancer (nginx, HAProxy) and the LB itself shows pressure — slow VIP, command or helper timeouts on the LB, failed IP lookups, or CPU/socket spikes while backends are healthy.

Identify duplicate hardware (MAC) addresses on the same network segment. Use when a helper surfaces a concrete duplicate `link/ether` value or an ARP entry that flips between two MACs for one IP.

Distinguish OSPF and FRR routing faults - ospf_neighbor_missing, ospf_area_misconfiguration, ospf_acl_block, and frr_service_down. Use when reachability failures follow routing paths, OSPF neighbors are missing, or routing daemons are suspect.

Identify per-host resource and load faults — sender or receiver resource contention, sender application delay, web DoS attack. Use when a host shows stress/flood-tool processes, CPU spikes, TCP socket spikes, or slow localhost responses while same-role peers stay clean.

Identify generic traffic-control faults — link bandwidth throttling, link packet corruption, incast traffic limitation. Use when tc qdisc output shows tbf or netem shaping on a network-path interface.