Debugging Network Issues

What it does

Guides Claude through a disciplined investigation of incidents like ECONNRESET, HTTP/2 RST_STREAM INTERNAL_ERROR, SSE / long-polling stalls, "always fails after N seconds", CDN/proxy/CGNAT idle timeouts, Cloudflare 524/522, TUN-proxy misrouting and TLS certificate-verification errors.

• Evidence over assumption — no root-cause claim without a concrete artifact (log line, pcap frame, probe output, metric sample).
• Falsification over confirmation — every hypothesis must come with "what observation would make me abandon this?".
• Layered isolation — run the same request through three paths differing by exactly one hop (via CDN, --resolve to origin, server loopback) to pin the responsible layer in minutes.
• Step 0 → Step 8 checklist — scope the symptom, verify the premise, gather evidence at every hop, frame ≥3 hypotheses with falsifiers and layer boundaries, run a decisive experiment, add env-gated instrumentation, counter-review, fix, then re-run the exact same experiment.
• Large-POST recipe — compare bytes_read to Content-Length and duration semantics to separate upload timeouts from processing timeouts.
• 15 cognitive traps — circumstantial-evidence convergence, field-semantic confusion, trusting a green health check that probes the wrong plane, CNAME rules overriding explicit PROXY rules, static-IP hosts orphaned by a subnet change, and more.

Who it's for

• Backend and SRE engineers running SSE/WebSocket/streaming APIs with unexplained disconnects.
• Infra owners tracing 524/522/504 across Cloudflare → Caddy/nginx → LB → app stacks.
• Developers on Clash/Shadowrocket/Surge TUN proxies where one site fails while everything else works.
• Teams that want Claude Code to investigate with evidence instead of suggesting a restart.

Examples

1. "Our SSE stream always dies at 130s." The skill demands the exact error string and timestamps, then designs a mock idle-upstream experiment to identify which hop's idle timeout fires.
2. "Cloudflare returns 524 on a 6 MB upload." It reads the Caddy log signature status=0, duration=125, bytes_read=4111422, Content-Length=6042141 and proves the body upload — not the backend — is the bottleneck.
3. "One site gives ERR_CONNECTION_CLOSED, all others are fine." It walks DNS (fake 198.18.x.x TUN IPs), route lookup, hostname-vs-IP through the proxy, and CNAME-suffix DIRECT rules overriding an explicit PROXY rule.

Install the skill I found on Claude Skill Mart.
Copy the debugging-network-issues folder from the GitHub repo daymade/claude-code-skills into my ~/.claude/skills/debugging-network-issues/.
When it's done, tell me in one line what this skill can do.