Network

Understand and troubleshoot computer networks with TCP/IP, DNS, routing, and diagnostic tools.

Security Scan

This is an instruction-only, educational network troubleshooting guide that is internally consistent with its stated purpose and does not request credentials, installs, or privileged persistence.

Purpose & Capability

The name/description match the SKILL.md content: a network fundamentals and troubleshooting guide. The skill declares no env vars, binaries, or installs — which is proportionate for an educational reference.

Instruction Scope

SKILL.md contains explanatory text and example commands (ping, traceroute, tcpdump, netstat, curl, ssh tunnels, etc.) but does not instruct the agent to read unrelated files, access credentials, or exfiltrate data. It does note commands that in practice may require elevated privileges (e.g., netstat -tulpn, tcpdump).

Install Mechanism

No install spec or code files are present; this is instruction-only, which minimizes on-disk risk.

Credentials

The skill requests no environment variables, credentials, or config paths — consistent with a reference/tutorial skill.

Persistence & Privilege

always is false and there is no attempt to persist configuration or modify other skills; the skill does not request elevated runtime privileges itself.

Scan Findings in Context

[no_code_files_or_scan_findings] expected: The regex-based scanner had no code files to analyze and produced no findings — expected for an instruction-only SKILL.md that contains plain-text guidance.

Assessment

This skill is a safe, educational network troubleshooting guide and does not ask for keys or install software. Be aware that many of the example commands require local execution and some need root/administrator rights; if you let an agent run those commands on your machine, review what will run first. Also note the skill's source/homepage is unknown — while the content appears benign, consider preferring skills from known publishers if provenance matters to you.

Network Fundamentals

TCP/IP Basics

• TCP guarantees delivery with retransmission — use for reliability (HTTP, SSH, databases)
• UDP is fire-and-forget — use for speed when loss is acceptable (video, gaming, DNS queries)
• Port numbers: 0-1023 privileged (need root), 1024-65535 available — common services have well-known ports
• Ephemeral ports for client connections — OS assigns randomly from high range

DNS

• DNS resolution is cached at multiple levels — browser, OS, router, ISP — flush all when debugging
• TTL determines cache duration — lower before migrations, raise after for performance
• A record for IPv4, AAAA for IPv6, CNAME for aliases, MX for mail
• CNAME cannot exist at zone apex (root domain) — use A record or provider-specific alias
• dig and nslookup query DNS directly — bypass local cache for accurate results

IP Addressing

• Private ranges: 10.x.x.x, 172.16-31.x.x, 192.168.x.x — not routable on internet
• CIDR notation: /24 = 256 IPs, /16 = 65536 IPs — each bit halves or doubles the range
• 127.0.0.1 is localhost — 0.0.0.0 means all interfaces, not a valid destination
• NAT translates private to public IPs — most home/office networks use this
• IPv6 eliminates NAT need — but dual-stack with IPv4 still common

Common Ports

• 22: SSH — 80: HTTP — 443: HTTPS — 53: DNS
• 25/465/587: SMTP (mail sending) — 143/993: IMAP — 110/995: POP3
• 3306: MySQL — 5432: PostgreSQL — 6379: Redis — 27017: MongoDB
• 3000/8080/8000: Common development servers

Troubleshooting Tools

• ping tests reachability — but ICMP may be blocked, no response doesn't mean down
• traceroute/tracert shows path — identifies where packets stop or slow down
• netstat -tulpn or ss -tulpn shows listening ports — find what's using a port
• curl -v shows full HTTP transaction — headers, timing, TLS negotiation
• tcpdump and Wireshark capture packets — last resort for deep debugging

Firewalls and NAT

• Stateful firewalls track connections — allow response to outbound requests automatically
• Port forwarding maps external port to internal IP:port — required to expose services behind NAT
• Hairpin NAT for internal access to external IP — not all routers support it
• UPnP auto-configures port forwarding — convenient but security risk, disable on servers

Load Balancing

• Round-robin distributes sequentially — simple but ignores server capacity
• Least connections sends to least busy — better for varying request durations
• Health checks remove dead servers — configure appropriate intervals and thresholds
• Sticky sessions (affinity) keep user on same server — needed for stateful apps, breaks scaling

VPNs and Tunnels

• VPN encrypts traffic to exit point — all traffic appears from VPN server IP
• Split tunneling sends only some traffic through VPN — reduces latency for local resources
• WireGuard is modern and fast — simpler than OpenVPN, better performance
• SSH tunnels for ad-hoc port forwarding — ssh -L local:remote:port creates secure tunnel

SSL/TLS

• TLS 1.2 minimum, prefer 1.3 — older versions have known vulnerabilities
• Certificate chain: leaf → intermediate → root — missing intermediate causes validation failures
• SNI allows multiple certs on one IP — older clients without SNI get default cert
• Let's Encrypt certs expire in 90 days — automate renewal or face outages

Common Mistakes

• Assuming DNS changes are instant — TTL means old records persist in caches
• Blocking ICMP entirely — breaks path MTU discovery, causes mysterious failures
• Forgetting IPv6 — services may be accessible on IPv6 even with IPv4 firewall
• Hardcoding IPs instead of hostnames — breaks when IPs change
• Not checking both TCP and UDP — some services need UDP (DNS, VPN, game servers)
• Confusing latency and bandwidth — high bandwidth doesn't mean low latency