메뉴
Identify a device that has been killed, stopped, or removed from the topology. Use when a device is completely unresponsive — ICMP fails, shell never opens, no service response — while same-role peers stay clean.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Integration-test skill only. Invoke at the start of every troubleshooting session before other diagnostics to confirm the NIKA skill library is loaded.
Identify ACL and firewall faults from nftables or iptables rules. Use when traffic is selectively blocked by protocol or service (ARP, ICMP, HTTP, DNS, BGP, or packet-size filtering).
Reference list of signals that look suspicious but are normal testbed behavior. Consult before promoting any observation to a symptom.
Identify BGP routing faults — ASN misconfiguration, missing route advertisement, prefix hijacking, blackhole route leak. Use when reachability failures follow BGP-routed paths, BGP sessions fail to establish, or expected prefixes are missing from peers.
Parse oversized MCP tool output. When a tool returns "Output has been saved to <file>.txt" because the result exceeded Claude Code's token limit, run this skill's parser instead of re-reading the file in chunks. Covers `get_reachability` on large topologies and `service_snapshot` on labs with many published hostnames.
Identify DHCP server-side faults — service down, missing subnet declaration, spoofed gateway or DNS pushed by the server. Use when one or more hosts cannot obtain a lease, or hosts received DHCP-supplied values that look wrong.
| name | host-crash-skill |
| description | Identify a device that has been killed, stopped, or removed from the topology. Use when a device is completely unresponsive — ICMP fails, shell never opens, no service response — while same-role peers stay clean. |
safe_reachability; do not rely on a name that the device itself resolves.exec_shell, infra_sweep exec_failed, and safe_reachability all fail on that device.All three must hold. Any partial response rules out host_crash.
is_anomaly=Trueroot_cause_name=["host_crash"]faulty_devices=["<device>"]If the unresponsive device is the load balancer and it still answers ICMP, localhost HTTP, or any partial VIP probe, that is probably load_balancer_overload. Use load-balancer-skill.
An isolated exec_failed/timeout on one web/app server or one client, while ICMP still answers or same-role peers are otherwise clean, is resource contention — not crash. Use resource-contention-skill. host_crash requires full silence and a clean same-role baseline.
If many same-role devices are unreachable together, or the routing/control-plane fabric is broken, the cause is upstream (link, ACL, OSPF/BGP, DHCP relay). Rerun the matching broad-search helper before submitting host_crash.