菜单
Identify per-host resource and load faults — sender or receiver resource contention, sender application delay, web DoS attack. Use when a host shows stress/flood-tool processes, CPU spikes, TCP socket spikes, or slow localhost responses while same-role peers stay clean.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Integration-test skill only. Invoke at the start of every troubleshooting session before other diagnostics to confirm the NIKA skill library is loaded.
Identify ACL and firewall faults from nftables or iptables rules. Use when traffic is selectively blocked by protocol or service (ARP, ICMP, HTTP, DNS, BGP, or packet-size filtering).
Reference list of signals that look suspicious but are normal testbed behavior. Consult before promoting any observation to a symptom.
Identify BGP routing faults — ASN misconfiguration, missing route advertisement, prefix hijacking, blackhole route leak. Use when reachability failures follow BGP-routed paths, BGP sessions fail to establish, or expected prefixes are missing from peers.
Parse oversized MCP tool output. When a tool returns "Output has been saved to <file>.txt" because the result exceeded Claude Code's token limit, run this skill's parser instead of re-reading the file in chunks. Covers `get_reachability` on large topologies and `service_snapshot` on labs with many published hostnames.
Identify DHCP server-side faults — service down, missing subnet declaration, spoofed gateway or DNS pushed by the server. Use when one or more hosts cannot obtain a lease, or hosts received DHCP-supplied values that look wrong.
| name | resource-contention-skill |
| description | Identify per-host resource and load faults — sender or receiver resource contention, sender application delay, web DoS attack. Use when a host shows stress/flood-tool processes, CPU spikes, TCP socket spikes, or slow localhost responses while same-role peers stay clean. |
A stress_tool / http_flood_tool entry means a RUNNING process surfaced by pressure_sweep. Installed binaries without a running process do not count.
One direct probe on the candidate to confirm ownership is enough — do not chain extra investigations once the family is confirmed.
host_crash means the container was killed/stopped/removed: no response at all, same-role peers clean. An isolated exec_failed/timeout on one web/app server while ICMP still answers is sender_resource_contention, not host_crash. Do not require seeing stress-ng in ps after the container is already too loaded to answer process probes.
Stay here only when the pressure signal is on a non-LB backend or client. If the flagged device is the load balancer, use load-balancer-skill.
Both produce a slow backend. sender_resource_contention requires a resource signal (stress_tool, cpu_hot_process, cpu_hot_service_daemon, tcp_estab_spike, or an isolated exec timeout). sender_application_delay fires only when the backend is slow AND no resource signal is present. If any resource flag fires, it is NOT sender_application_delay.
stress_tool consumes local CPU/memory — the faulty device is the host running it. http_flood_tool drives abusive traffic at a victim — the faulty device is the victim, not the attacker.
