메뉴
Identify per-host L2/L3 identity faults — IP conflict, wrong IP, wrong gateway, wrong netmask, missing IP, host-local resolv.conf misconfig, static `arp -s` poisoning. Use when one host (or a small minority) shows an addressing anomaly its same-subnet peers do not share.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Integration-test skill only. Invoke at the start of every troubleshooting session before other diagnostics to confirm the NIKA skill library is loaded.
Identify ACL and firewall faults from nftables or iptables rules. Use when traffic is selectively blocked by protocol or service (ARP, ICMP, HTTP, DNS, BGP, or packet-size filtering).
Reference list of signals that look suspicious but are normal testbed behavior. Consult before promoting any observation to a symptom.
Identify BGP routing faults — ASN misconfiguration, missing route advertisement, prefix hijacking, blackhole route leak. Use when reachability failures follow BGP-routed paths, BGP sessions fail to establish, or expected prefixes are missing from peers.
Parse oversized MCP tool output. When a tool returns "Output has been saved to <file>.txt" because the result exceeded Claude Code's token limit, run this skill's parser instead of re-reading the file in chunks. Covers `get_reachability` on large topologies and `service_snapshot` on labs with many published hostnames.
Identify DHCP server-side faults — service down, missing subnet declaration, spoofed gateway or DNS pushed by the server. Use when one or more hosts cannot obtain a lease, or hosts received DHCP-supplied values that look wrong.
| name | host-ip-skill |
| description | Identify per-host L2/L3 identity faults — IP conflict, wrong IP, wrong gateway, wrong netmask, missing IP, host-local resolv.conf misconfig, static `arp -s` poisoning. Use when one host (or a small minority) shows an addressing anomaly its same-subnet peers do not share. |
Transient or intermittent host-identity symptoms — short lease, lost default route, missing IP, conflicting interface-state readings between probes — frequently originate from an unstable access link, not from host configuration. Confirm the access interface is present and stable before classifying anything in this family. If the interface is currently DOWN or missing, or is actively flapping, the case belongs to link-fault-skill, not here.
A low carrier-changes counter alone is not a link fault — startup history can produce a small number of transitions on a currently healthy link. Use it as supporting context, not as a family switch.
The host's evidence must be distinctive — same-subnet peers do not share it. If many hosts share the same anomaly, the cause is upstream (routing / DHCP / ACL / control plane) and this skill does not own it; see Disambiguation.
When a host has no IPv4 address and the access interface is UP and stable, more than one upstream cause produces the same symptom. Before submitting a host-side missing-IP fault, rule out: a duplicate MAC against the gateway or another switch, a broken routing / control-plane path to the DHCP server, and an ARP ACL drop or empty (<incomplete>) gateway neighbor entry on the host. If any of those fires, the owning family is elsewhere.
When direct evidence is sufficient (link ruled out, peers don't share the symptom, and the cross-family checks above are clear for missing-IP cases), submit. Do not chain extra probes once the family is confirmed.
dhcp-fault-skill), not this one.<incomplete> gateway neighbor entry breaks DHCP lease renewal and produces the same symptom as a host-side missing IP. Check the host's neighbor table and ruleset before submitting; if either fires, the owning family is acl-skill.<incomplete> / zero-MAC gateway entry leans toward acl-skill (ARP filtered). A populated entry whose MAC does not match the gateway router's real interface MAC, or any entry carrying a static / permanent flag, is ARP cache poisoning. A populated entry matching the gateway router's real MAC is healthy.