菜单
Identify load-balancer-side service faults. Use when the topology includes a load balancer (nginx, HAProxy) and the LB itself shows pressure — slow VIP, command or helper timeouts on the LB, failed IP lookups, or CPU/socket spikes while backends are healthy.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Integration-test skill only. Invoke at the start of every troubleshooting session before other diagnostics to confirm the NIKA skill library is loaded.
Identify ACL and firewall faults from nftables or iptables rules. Use when traffic is selectively blocked by protocol or service (ARP, ICMP, HTTP, DNS, BGP, or packet-size filtering).
Reference list of signals that look suspicious but are normal testbed behavior. Consult before promoting any observation to a symptom.
Identify BGP routing faults — ASN misconfiguration, missing route advertisement, prefix hijacking, blackhole route leak. Use when reachability failures follow BGP-routed paths, BGP sessions fail to establish, or expected prefixes are missing from peers.
Parse oversized MCP tool output. When a tool returns "Output has been saved to <file>.txt" because the result exceeded Claude Code's token limit, run this skill's parser instead of re-reading the file in chunks. Covers `get_reachability` on large topologies and `service_snapshot` on labs with many published hostnames.
Identify DHCP server-side faults — service down, missing subnet declaration, spoofed gateway or DNS pushed by the server. Use when one or more hosts cannot obtain a lease, or hosts received DHCP-supplied values that look wrong.
| name | load-balancer-skill |
| description | Identify load-balancer-side service faults. Use when the topology includes a load balancer (nginx, HAProxy) and the LB itself shows pressure — slow VIP, command or helper timeouts on the LB, failed IP lookups, or CPU/socket spikes while backends are healthy. |
safe_reachability or a host's resolver; do not rely on a name lookup that itself depends on the LB.exec_shell hangs, infra_sweep reports exec_failed on the LB, safe_reachability IP lookup fails on the LB, or pressure_sweep times out on the LB.is_anomaly=Trueroot_cause_name=["load_balancer_overload"]faulty_devices=["<load_balancer_device_name>"]One direct probe to confirm the pattern is enough. Do not chain extra investigations once two fingerprints match.
host_crash means the container was killed/stopped/removed: no ICMP, no response of any kind, and the same-role baseline stays clean. Any partial LB response — ICMP reply, partial HTTP, localhost nginx answer — rules out host_crash.
Switch only if a running HTTP flood tool (ab, wrk, hping3, hey, httperf, siege, vegeta, locust) is found on an attacker host and targets the LB/VIP. Probe-traffic log entries are not flood evidence.
Stay here when the LB itself is the flagged device. Route to resource-contention-skill only when the direct pressure signal is on a non-LB backend or client and the LB stays clean.