메뉴
Identify DHCP server-side faults — service down, missing subnet declaration, spoofed gateway or DNS pushed by the server. Use when one or more hosts cannot obtain a lease, or hosts received DHCP-supplied values that look wrong.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Integration-test skill only. Invoke at the start of every troubleshooting session before other diagnostics to confirm the NIKA skill library is loaded.
Identify ACL and firewall faults from nftables or iptables rules. Use when traffic is selectively blocked by protocol or service (ARP, ICMP, HTTP, DNS, BGP, or packet-size filtering).
Reference list of signals that look suspicious but are normal testbed behavior. Consult before promoting any observation to a symptom.
Identify BGP routing faults — ASN misconfiguration, missing route advertisement, prefix hijacking, blackhole route leak. Use when reachability failures follow BGP-routed paths, BGP sessions fail to establish, or expected prefixes are missing from peers.
Parse oversized MCP tool output. When a tool returns "Output has been saved to <file>.txt" because the result exceeded Claude Code's token limit, run this skill's parser instead of re-reading the file in chunks. Covers `get_reachability` on large topologies and `service_snapshot` on labs with many published hostnames.
Broad-search escalation toolbox. Enter when the blind start surfaces no symptom. Run phases in order, and exit the moment a helper surfaces an anomaly.
| name | dhcp-fault-skill |
| description | Identify DHCP server-side faults — service down, missing subnet declaration, spoofed gateway or DNS pushed by the server. Use when one or more hosts cannot obtain a lease, or hosts received DHCP-supplied values that look wrong. |
The agent must show direct evidence on the DHCP server before submitting any DHCP fault. Hosts having no IP is downstream — it does NOT prove the DHCP server is the cause.
A broken path to the DHCP server looks identical to a server-side fault from the affected host's perspective. Before submitting any DHCP fault, confirm the upstream isn't the real cause: the routing / control plane between the affected host and the DHCP server must be healthy, no ACL on the relay path may be dropping lease traffic, and the server itself must be reachable from the host's access gateway or relay. If any of those is broken, the upstream wins.
A host having no IP, an expired lease, or a short valid_lft is NOT direct evidence of a DHCP fault by itself — only a dead daemon or a wrong server configuration is.
When direct evidence on the DHCP server is sufficient AND the upstream cascade has been ruled out, submit. Do not chain extra probes once the family is confirmed.
/etc/resolv.conf or default route differs from what was pushed, that's host-ip-skill territory.dhcp_service_down. The cascade guard above must pass first.systemctl inactive is not enough. systemctl is-active may report inactive for services that are actually running under a different init pattern. Combine with pgrep (or equivalent process check) to confirm the daemon is actually absent before naming a service-down fault.dhcp_missing_subnet vs dhcp_spoofed_subnet. Both produce the same direct evidence (a subnet block missing from dhcpd.conf for an affected host's subnet). The label follows the scenario's category: dhcp_missing_subnet under misconfiguration scenarios, dhcp_spoofed_subnet under network-attack scenarios. Check list_avail_problems() to see which name is valid for the current scenario before submitting.