메뉴
Identify BGP routing faults — ASN misconfiguration, missing route advertisement, prefix hijacking, blackhole route leak. Use when reachability failures follow BGP-routed paths, BGP sessions fail to establish, or expected prefixes are missing from peers.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Integration-test skill only. Invoke at the start of every troubleshooting session before other diagnostics to confirm the NIKA skill library is loaded.
Identify ACL and firewall faults from nftables or iptables rules. Use when traffic is selectively blocked by protocol or service (ARP, ICMP, HTTP, DNS, BGP, or packet-size filtering).
Reference list of signals that look suspicious but are normal testbed behavior. Consult before promoting any observation to a symptom.
Parse oversized MCP tool output. When a tool returns "Output has been saved to <file>.txt" because the result exceeded Claude Code's token limit, run this skill's parser instead of re-reading the file in chunks. Covers `get_reachability` on large topologies and `service_snapshot` on labs with many published hostnames.
Identify DHCP server-side faults — service down, missing subnet declaration, spoofed gateway or DNS pushed by the server. Use when one or more hosts cannot obtain a lease, or hosts received DHCP-supplied values that look wrong.
Broad-search escalation toolbox. Enter when the blind start surfaces no symptom. Run phases in order, and exit the moment a helper surfaces an anomaly.
| name | bgp-fault-skill |
| description | Identify BGP routing faults — ASN misconfiguration, missing route advertisement, prefix hijacking, blackhole route leak. Use when reachability failures follow BGP-routed paths, BGP sessions fail to establish, or expected prefixes are missing from peers. |
bgp_asn_misconfig: the router's local ASN does not match what its peers expect, so BGP sessions fail to establish.bgp_missing_route_advertisement: a network statement for a locally-attached prefix is missing from the router's router bgp block, so peers never learn that prefix.bgp_hijacking: a router loopback claims a service IP/prefix that belongs elsewhere, and BGP advertises it, so traffic is pulled to the wrong router.bgp_blackhole_route_leak: a static route to Null0 is configured inside FRR and advertised into BGP via a matching network statement, attracting traffic that is then dropped.host_static_blackhole: a kernel-level blackhole route (ip route ... blackhole) is installed on a router for a directly-attached host subnet. There is no ip route ... Null0 line in the FRR running-config; the prefix is the host's own subnet, which BGP already advertises as part of normal baseline config.router_name, not host_name.exec_shell(host_name="<router>", command="vtysh -c '...'").frr_show_running_config and frr_show_ip_route can look clean when the daemon is dead; they are secondary evidence.bgp_hijacking requires both the loopback IP AND the advertising network statement — one alone is not a hijack.bgp_blackhole_route_leak requires both an FRR-config ip route <P> Null0 line and a matching network <P> advertisement under router bgp. A pre-existing network for a router's normal attached subnet is not enough on its own.host_static_blackhole requires a kernel-level blackhole route on the router for an attached host subnet, with no corresponding ip route ... Null0 line in the FRR running-config. If you see a kernel blackhole and immediately conclude bgp_blackhole_route_leak because the prefix also appears as a network statement, you have misclassified — the network statement is normal baseline config; the leak label requires the explicit FRR-config Null0 line.