[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6N458EMXWVJRF6D7N6NFFSW":3,"skill-same:01M6N458EMXWVJRF6D7N6NFFSW":92},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":27,"publishedAt":48,"linkOnly":49,"markdownContent":50,"markdownBody":51,"frontMatter":52,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":67,"repositoryHtmlUrl":68,"repositoryHomepageUrl":6,"ownerHtmlUrl":69,"ownerBlogUrl":6,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6N458EMXWVJRF6D7N6NFFSW","dns-networking",null,"Debug DNS resolution and network connectivity. Use when troubleshooting DNS failures, testing port connectivity, diagnosing firewall rules, inspecting HTTP requests with curl verbose mode, configuring \u002Fetc\u002Fhosts, or debugging proxy and certificate issues.","Kernel8901\u002Fai-agent-skills-classification","Kernel8901","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F72647553?v=4","01M6KV388J2H5PNC8D8P940BJD","01M6KV38CS5B3AY63RKZB410YM",7,"MIT","https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F代码质量与测试\u002Fdns-networking\u002FSKILL.md",[17,22],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":25,"taxonomyTypeDesc":26},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47],"networking","dns networking","dns","network","darwin","hosts","mode","port","use","Rules","certificate","firewall","testing","proxy","issues","win32","debugging","http","debug","linux","2026-11-10 10:12:30",false,"---\nname: dns-networking\ndescription: Debug DNS resolution and network connectivity. Use when troubleshooting DNS failures, testing port connectivity, diagnosing firewall rules, inspecting HTTP requests with curl verbose mode, configuring \u002Fetc\u002Fhosts, or debugging proxy and certificate issues.\nmetadata: {\"clawdbot\":{\"emoji\":\"?\",\"requires\":{\"anyBins\":[\"dig\",\"nslookup\",\"curl\",\"ping\",\"nc\"]},\"os\":[\"linux\",\"darwin\",\"win32\"]}}\n---\n\n# DNS & Networking\n\nDebug DNS resolution, network connectivity, and HTTP issues. Covers dig\u002Fnslookup, port testing, firewall rules, curl diagnostics, \u002Fetc\u002Fhosts, proxy configuration, and certificate troubleshooting.\n\n## When to Use\n\n- DNS name not resolving or resolving to wrong IP\n- Connection refused \u002F connection timed out errors\n- Diagnosing firewall or security group rules\n- HTTP requests failing for unclear reasons\n- Proxy configuration issues\n- SSL\u002FTLS certificate errors\n- Testing connectivity between services\n\n## DNS Debugging\n\n### Query DNS records\n\n```bash\n# A record (IP address)\ndig example.com\ndig +short example.com\n\n# Specific record types\ndig example.com MX        # Mail servers\ndig example.com CNAME     # Aliases\ndig example.com TXT       # Text records (SPF, DKIM, etc.)\ndig example.com NS        # Name servers\ndig example.com AAAA      # IPv6 address\ndig example.com SOA       # Start of Authority\n\n# Query a specific DNS server\ndig @8.8.8.8 example.com\ndig @1.1.1.1 example.com\n\n# Trace the full resolution path\ndig +trace example.com\n\n# Reverse lookup (IP → hostname)\ndig -x 93.184.216.34\n\n# nslookup (simpler, works everywhere)\nnslookup example.com\nnslookup example.com 8.8.8.8    # Query specific server\nnslookup -type=MX example.com\n\n# host (simplest)\nhost example.com\nhost -t MX example.com\n```\n\n### Check DNS propagation\n\n```bash\n# Query multiple public DNS servers\nfor dns in 8.8.8.8 1.1.1.1 9.9.9.9 208.67.222.222; do\n    echo -n \"$dns: \"\n    dig +short @\"$dns\" example.com\ndone\n\n# Check TTL (time to live)\ndig example.com | grep -E '^\\S+\\s+\\d+\\s+IN\\s+A'\n# The number is TTL in seconds\n```\n\n### Local DNS issues\n\n```bash\n# Check \u002Fetc\u002Fresolv.conf (which DNS server the system uses)\ncat \u002Fetc\u002Fresolv.conf\n\n# Check \u002Fetc\u002Fhosts (local overrides)\ncat \u002Fetc\u002Fhosts\n\n# Flush DNS cache\n# macOS:\nsudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder\n# Linux (systemd-resolved):\nsudo systemd-resolve --flush-caches\n# Windows:\nipconfig \u002Fflushdns\n\n# Check if systemd-resolved is running (Linux)\nresolvectl status\n```\n\n### \u002Fetc\u002Fhosts patterns\n\n```bash\n# \u002Fetc\u002Fhosts — local DNS overrides (no TTL, instant)\n\n# Point a domain to localhost (for development)\n127.0.0.1    myapp.local\n127.0.0.1    api.myapp.local\n\n# Block a domain\n0.0.0.0      ads.example.com\n\n# Test a migration (point domain to new server before DNS change)\n203.0.113.50    example.com\n203.0.113.50    www.example.com\n\n# Multiple names for one IP\n192.168.1.100   db.local redis.local cache.local\n```\n\n## Port and Connectivity Testing\n\n### Test if a port is open\n\n```bash\n# nc (netcat) — most reliable\nnc -zv example.com 443\nnc -zv -w 5 example.com 80    # 5 second timeout\n\n# Test multiple ports\nfor port in 22 80 443 5432 6379; do\n    nc -zv -w 2 example.com $port 2>&1\ndone\n\n# \u002Fdev\u002Ftcp (bash built-in, no extra tools needed)\ntimeout 3 bash -c 'echo > \u002Fdev\u002Ftcp\u002Fexample.com\u002F443' && echo \"Open\" || echo \"Closed\"\n\n# curl (also tests HTTP)\ncurl -sI -o \u002Fdev\u002Fnull -w \"%{http_code}\" https:\u002F\u002Fexample.com\n\n# Test from inside a Docker container\ndocker exec my-container nc -zv db 5432\n```\n\n### Network path diagnostics\n\n```bash\n# traceroute (show network hops)\ntraceroute example.com\n\n# mtr (continuous traceroute with stats — best for finding packet loss)\nmtr example.com\nmtr -r -c 20 example.com   # Report mode, 20 packets\n\n# ping\nping -c 5 example.com\n\n# Show local network interfaces\nip addr show          # Linux\nifconfig              # macOS \u002F older Linux\n\n# Show routing table\nip route show         # Linux\nnetstat -rn           # macOS\nroute -n              # Linux (older)\n```\n\n### Check listening ports\n\n```bash\n# What's listening on which port (Linux)\nss -tlnp\nss -tlnp | grep :8080\n\n# macOS\nlsof -i -P -n | grep LISTEN\nlsof -i :8080\n\n# Older Linux\nnetstat -tlnp\nnetstat -tlnp | grep :8080\n\n# Which process is using a port\nlsof -i :3000\nfuser 3000\u002Ftcp   # Linux\n```\n\n## curl Diagnostics\n\n### Verbose request inspection\n\n```bash\n# Full verbose output (headers, TLS handshake, timing)\ncurl -v https:\u002F\u002Fapi.example.com\u002Fendpoint\n\n# Show timing breakdown\ncurl -o \u002Fdev\u002Fnull -s -w \"\n    DNS:        %{time_namelookup}s\n    Connect:    %{time_connect}s\n    TLS:        %{time_appconnect}s\n    TTFB:       %{time_starttransfer}s\n    Total:      %{time_total}s\n    Status:     %{http_code}\n    Size:       %{size_download} bytes\n\" https:\u002F\u002Fapi.example.com\u002Fendpoint\n\n# Show response headers only\ncurl -sI https:\u002F\u002Fapi.example.com\u002Fendpoint\n\n# Follow redirects and show each hop\ncurl -sIL https:\u002F\u002Fexample.com\n\n# Resolve a domain to a specific IP (bypass DNS)\ncurl --resolve example.com:443:203.0.113.50 https:\u002F\u002Fexample.com\n\n# Use a specific network interface\ncurl --interface eth1 https:\u002F\u002Fexample.com\n```\n\n### Debug common HTTP issues\n\n```bash\n# Test with different HTTP versions\ncurl --http1.1 https:\u002F\u002Fexample.com\ncurl --http2 https:\u002F\u002Fexample.com\n\n# Test with specific TLS version\ncurl --tlsv1.2 https:\u002F\u002Fexample.com\ncurl --tlsv1.3 https:\u002F\u002Fexample.com\n\n# Ignore certificate errors (debugging only)\ncurl -k https:\u002F\u002Fself-signed.example.com\n\n# Send request with custom Host header (virtual hosts)\ncurl -H \"Host: example.com\" https:\u002F\u002F203.0.113.50\u002F\n\n# Test CORS preflight\ncurl -X OPTIONS -H \"Origin: http:\u002F\u002Flocalhost:3000\" \\\n     -H \"Access-Control-Request-Method: POST\" \\\n     -v https:\u002F\u002Fapi.example.com\u002Fendpoint\n```\n\n## Firewall Basics\n\n### iptables (Linux)\n\n```bash\n# List all rules\nsudo iptables -L -n -v\n\n# Allow incoming on port 80\nsudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT\n\n# Allow incoming from specific IP\nsudo iptables -A INPUT -s 203.0.113.0\u002F24 -p tcp --dport 22 -j ACCEPT\n\n# Block incoming on a port\nsudo iptables -A INPUT -p tcp --dport 3306 -j DROP\n\n# Save rules (persist across reboot)\nsudo iptables-save > \u002Fetc\u002Fiptables\u002Frules.v4\n```\n\n### ufw (simpler, Ubuntu\u002FDebian)\n\n```bash\n# Enable\nsudo ufw enable\n\n# Allow\u002Fdeny\nsudo ufw allow 80\u002Ftcp\nsudo ufw allow 443\u002Ftcp\nsudo ufw allow from 203.0.113.0\u002F24 to any port 22\nsudo ufw deny 3306\n\n# Check status\nsudo ufw status verbose\n\n# Reset all rules\nsudo ufw reset\n```\n\n### macOS firewall\n\n```bash\n# Check status\nsudo \u002Fusr\u002Flibexec\u002FApplicationFirewall\u002Fsocketfilterfw --getglobalstate\n\n# Enable\nsudo \u002Fusr\u002Flibexec\u002FApplicationFirewall\u002Fsocketfilterfw --setglobalstate on\n\n# Allow an application\nsudo \u002Fusr\u002Flibexec\u002FApplicationFirewall\u002Fsocketfilterfw --add \u002Fusr\u002Flocal\u002Fbin\u002Fmyapp\n```\n\n## Proxy Configuration\n\n### Environment variables\n\n```bash\n# Set proxy for most CLI tools\nexport HTTP_PROXY=http:\u002F\u002Fproxy.example.com:8080\nexport HTTPS_PROXY=http:\u002F\u002Fproxy.example.com:8080\nexport NO_PROXY=localhost,127.0.0.1,.internal.example.com\n\n# For curl specifically\nexport http_proxy=http:\u002F\u002Fproxy.example.com:8080  # lowercase also works\n\n# With authentication\nexport HTTPS_PROXY=http:\u002F\u002Fuser:password@proxy.example.com:8080\n```\n\n### Test through proxy\n\n```bash\n# curl with explicit proxy\ncurl -x http:\u002F\u002Fproxy.example.com:8080 https:\u002F\u002Fhttpbin.org\u002Fip\n\n# SOCKS proxy\ncurl --socks5 localhost:1080 https:\u002F\u002Fhttpbin.org\u002Fip\n\n# Verify your external IP through proxy\ncurl -x http:\u002F\u002Fproxy:8080 https:\u002F\u002Fhttpbin.org\u002Fip\ncurl https:\u002F\u002Fhttpbin.org\u002Fip  # Compare with direct\n\n# Test proxy connectivity\ncurl -v -x http:\u002F\u002Fproxy:8080 https:\u002F\u002Fexample.com 2>&1 | grep -i \"proxy\\|connect\"\n```\n\n### Common proxy issues\n\n```bash\n# Node.js fetch\u002Fundici does NOT respect HTTP_PROXY\n# Use undici ProxyAgent or node-fetch with http-proxy-agent\n\n# Git through proxy\ngit config --global http.proxy http:\u002F\u002Fproxy:8080\ngit config --global https.proxy http:\u002F\u002Fproxy:8080\n# Remove:\ngit config --global --unset http.proxy\n\n# npm through proxy\nnpm config set proxy http:\u002F\u002Fproxy:8080\nnpm config set https-proxy http:\u002F\u002Fproxy:8080\n\n# pip through proxy\npip install --proxy http:\u002F\u002Fproxy:8080 package-name\n```\n\n## Certificate Troubleshooting\n\n```bash\n# Check certificate from a server\necho | openssl s_client -connect example.com:443 -servername example.com 2>\u002Fdev\u002Fnull | \\\n  openssl x509 -noout -subject -issuer -dates\n\n# Check expiry\necho | openssl s_client -connect example.com:443 2>\u002Fdev\u002Fnull | \\\n  openssl x509 -noout -enddate\n\n# Download certificate chain\nopenssl s_client -showcerts -connect example.com:443 \u003C \u002Fdev\u002Fnull 2>\u002Fdev\u002Fnull | \\\n  awk '\u002FBEGIN CERT\u002F,\u002FEND CERT\u002F' > chain.pem\n\n# Verify a certificate against CA bundle\nopenssl verify -CAfile \u002Fetc\u002Fssl\u002Fcerts\u002Fca-certificates.crt server.pem\n\n# Check certificate for a specific hostname (SNI)\nopenssl s_client -connect cdn.example.com:443 -servername cdn.example.com\n\n# Common error: \"certificate has expired\"\n# Check the date on the server:\ndate\n# If the system clock is wrong, certs will appear invalid\n```\n\n## Quick Diagnostics Script\n\n```bash\n#!\u002Fbin\u002Fbash\n# net-check.sh — Quick network diagnostics\nTARGET=\"${1:?Usage: net-check.sh \u003Chostname> [port]}\"\nPORT=\"${2:-443}\"\n\necho \"=== Network Check: $TARGET:$PORT ===\"\n\necho -n \"DNS resolution: \"\nIP=$(dig +short \"$TARGET\" | head -1)\n[[ -n \"$IP\" ]] && echo \"$IP\" || echo \"FAILED\"\n\necho -n \"Ping: \"\nping -c 1 -W 3 \"$TARGET\" > \u002Fdev\u002Fnull 2>&1 && echo \"OK\" || echo \"FAILED (may be blocked)\"\n\necho -n \"Port $PORT: \"\nnc -zv -w 5 \"$TARGET\" \"$PORT\" 2>&1 | grep -q \"succeeded\\|open\" && echo \"OPEN\" || echo \"CLOSED\u002FFILTERED\"\n\nif [[ \"$PORT\" == \"443\" || \"$PORT\" == \"8443\" ]]; then\n    echo -n \"TLS: \"\n    echo | openssl s_client -connect \"$TARGET:$PORT\" -servername \"$TARGET\" 2>\u002Fdev\u002Fnull | \\\n      grep -q \"Verify return code: 0\" && echo \"VALID\" || echo \"INVALID\u002FERROR\"\n\n    echo -n \"Certificate expiry: \"\n    echo | openssl s_client -connect \"$TARGET:$PORT\" 2>\u002Fdev\u002Fnull | \\\n      openssl x509 -noout -enddate 2>\u002Fdev\u002Fnull | sed 's\u002FnotAfter=\u002F\u002F'\nfi\n\necho \"=== Done ===\"\n```\n\n## Tips\n\n- `dig +short` is the fastest way to check DNS from the command line. Use `@8.8.8.8` to bypass local caching.\n- `nc -zv` is the simplest port connectivity test. If nc isn't available, use bash's `\u002Fdev\u002Ftcp`.\n- curl's `-w` format string with timing variables is the fastest way to diagnose slow HTTP requests: DNS, connect, TLS, and TTFB are all visible.\n- DNS changes propagate based on TTL. Check the current TTL with `dig` before expecting a DNS change to take effect.\n- `\u002Fetc\u002Fhosts` changes take effect immediately (no TTL, no propagation delay). Use it to test domain migrations before changing DNS.\n- When debugging \"connection refused\": first verify the port is open with `nc`, then check the service is actually listening with `ss -tlnp` or `lsof -i`.\n- `mtr` is better than `traceroute` for diagnosing packet loss — it runs continuously and shows per-hop loss percentages.\n- Node.js, Python `requests`, and many libraries do NOT automatically use `HTTP_PROXY` environment variables. Check each tool's proxy documentation.\n","# DNS & Networking\n\nDebug DNS resolution, network connectivity, and HTTP issues. Covers dig\u002Fnslookup, port testing, firewall rules, curl diagnostics, \u002Fetc\u002Fhosts, proxy configuration, and certificate troubleshooting.\n\n## When to Use\n\n- DNS name not resolving or resolving to wrong IP\n- Connection refused \u002F connection timed out errors\n- Diagnosing firewall or security group rules\n- HTTP requests failing for unclear reasons\n- Proxy configuration issues\n- SSL\u002FTLS certificate errors\n- Testing connectivity between services\n\n## DNS Debugging\n\n### Query DNS records\n\n```bash\n# A record (IP address)\ndig example.com\ndig +short example.com\n\n# Specific record types\ndig example.com MX        # Mail servers\ndig example.com CNAME     # Aliases\ndig example.com TXT       # Text records (SPF, DKIM, etc.)\ndig example.com NS        # Name servers\ndig example.com AAAA      # IPv6 address\ndig example.com SOA       # Start of Authority\n\n# Query a specific DNS server\ndig @8.8.8.8 example.com\ndig @1.1.1.1 example.com\n\n# Trace the full resolution path\ndig +trace example.com\n\n# Reverse lookup (IP → hostname)\ndig -x 93.184.216.34\n\n# nslookup (simpler, works everywhere)\nnslookup example.com\nnslookup example.com 8.8.8.8    # Query specific server\nnslookup -type=MX example.com\n\n# host (simplest)\nhost example.com\nhost -t MX example.com\n```\n\n### Check DNS propagation\n\n```bash\n# Query multiple public DNS servers\nfor dns in 8.8.8.8 1.1.1.1 9.9.9.9 208.67.222.222; do\n    echo -n \"$dns: \"\n    dig +short @\"$dns\" example.com\ndone\n\n# Check TTL (time to live)\ndig example.com | grep -E '^\\S+\\s+\\d+\\s+IN\\s+A'\n# The number is TTL in seconds\n```\n\n### Local DNS issues\n\n```bash\n# Check \u002Fetc\u002Fresolv.conf (which DNS server the system uses)\ncat \u002Fetc\u002Fresolv.conf\n\n# Check \u002Fetc\u002Fhosts (local overrides)\ncat \u002Fetc\u002Fhosts\n\n# Flush DNS cache\n# macOS:\nsudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder\n# Linux (systemd-resolved):\nsudo systemd-resolve --flush-caches\n# Windows:\nipconfig \u002Fflushdns\n\n# Check if systemd-resolved is running (Linux)\nresolvectl status\n```\n\n### \u002Fetc\u002Fhosts patterns\n\n```bash\n# \u002Fetc\u002Fhosts — local DNS overrides (no TTL, instant)\n\n# Point a domain to localhost (for development)\n127.0.0.1    myapp.local\n127.0.0.1    api.myapp.local\n\n# Block a domain\n0.0.0.0      ads.example.com\n\n# Test a migration (point domain to new server before DNS change)\n203.0.113.50    example.com\n203.0.113.50    www.example.com\n\n# Multiple names for one IP\n192.168.1.100   db.local redis.local cache.local\n```\n\n## Port and Connectivity Testing\n\n### Test if a port is open\n\n```bash\n# nc (netcat) — most reliable\nnc -zv example.com 443\nnc -zv -w 5 example.com 80    # 5 second timeout\n\n# Test multiple ports\nfor port in 22 80 443 5432 6379; do\n    nc -zv -w 2 example.com $port 2>&1\ndone\n\n# \u002Fdev\u002Ftcp (bash built-in, no extra tools needed)\ntimeout 3 bash -c 'echo > \u002Fdev\u002Ftcp\u002Fexample.com\u002F443' && echo \"Open\" || echo \"Closed\"\n\n# curl (also tests HTTP)\ncurl -sI -o \u002Fdev\u002Fnull -w \"%{http_code}\" https:\u002F\u002Fexample.com\n\n# Test from inside a Docker container\ndocker exec my-container nc -zv db 5432\n```\n\n### Network path diagnostics\n\n```bash\n# traceroute (show network hops)\ntraceroute example.com\n\n# mtr (continuous traceroute with stats — best for finding packet loss)\nmtr example.com\nmtr -r -c 20 example.com   # Report mode, 20 packets\n\n# ping\nping -c 5 example.com\n\n# Show local network interfaces\nip addr show          # Linux\nifconfig              # macOS \u002F older Linux\n\n# Show routing table\nip route show         # Linux\nnetstat -rn           # macOS\nroute -n              # Linux (older)\n```\n\n### Check listening ports\n\n```bash\n# What's listening on which port (Linux)\nss -tlnp\nss -tlnp | grep :8080\n\n# macOS\nlsof -i -P -n | grep LISTEN\nlsof -i :8080\n\n# Older Linux\nnetstat -tlnp\nnetstat -tlnp | grep :8080\n\n# Which process is using a port\nlsof -i :3000\nfuser 3000\u002Ftcp   # Linux\n```\n\n## curl Diagnostics\n\n### Verbose request inspection\n\n```bash\n# Full verbose output (headers, TLS handshake, timing)\ncurl -v https:\u002F\u002Fapi.example.com\u002Fendpoint\n\n# Show timing breakdown\ncurl -o \u002Fdev\u002Fnull -s -w \"\n    DNS:        %{time_namelookup}s\n    Connect:    %{time_connect}s\n    TLS:        %{time_appconnect}s\n    TTFB:       %{time_starttransfer}s\n    Total:      %{time_total}s\n    Status:     %{http_code}\n    Size:       %{size_download} bytes\n\" https:\u002F\u002Fapi.example.com\u002Fendpoint\n\n# Show response headers only\ncurl -sI https:\u002F\u002Fapi.example.com\u002Fendpoint\n\n# Follow redirects and show each hop\ncurl -sIL https:\u002F\u002Fexample.com\n\n# Resolve a domain to a specific IP (bypass DNS)\ncurl --resolve example.com:443:203.0.113.50 https:\u002F\u002Fexample.com\n\n# Use a specific network interface\ncurl --interface eth1 https:\u002F\u002Fexample.com\n```\n\n### Debug common HTTP issues\n\n```bash\n# Test with different HTTP versions\ncurl --http1.1 https:\u002F\u002Fexample.com\ncurl --http2 https:\u002F\u002Fexample.com\n\n# Test with specific TLS version\ncurl --tlsv1.2 https:\u002F\u002Fexample.com\ncurl --tlsv1.3 https:\u002F\u002Fexample.com\n\n# Ignore certificate errors (debugging only)\ncurl -k https:\u002F\u002Fself-signed.example.com\n\n# Send request with custom Host header (virtual hosts)\ncurl -H \"Host: example.com\" https:\u002F\u002F203.0.113.50\u002F\n\n# Test CORS preflight\ncurl -X OPTIONS -H \"Origin: http:\u002F\u002Flocalhost:3000\" \\\n     -H \"Access-Control-Request-Method: POST\" \\\n     -v https:\u002F\u002Fapi.example.com\u002Fendpoint\n```\n\n## Firewall Basics\n\n### iptables (Linux)\n\n```bash\n# List all rules\nsudo iptables -L -n -v\n\n# Allow incoming on port 80\nsudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT\n\n# Allow incoming from specific IP\nsudo iptables -A INPUT -s 203.0.113.0\u002F24 -p tcp --dport 22 -j ACCEPT\n\n# Block incoming on a port\nsudo iptables -A INPUT -p tcp --dport 3306 -j DROP\n\n# Save rules (persist across reboot)\nsudo iptables-save > \u002Fetc\u002Fiptables\u002Frules.v4\n```\n\n### ufw (simpler, Ubuntu\u002FDebian)\n\n```bash\n# Enable\nsudo ufw enable\n\n# Allow\u002Fdeny\nsudo ufw allow 80\u002Ftcp\nsudo ufw allow 443\u002Ftcp\nsudo ufw allow from 203.0.113.0\u002F24 to any port 22\nsudo ufw deny 3306\n\n# Check status\nsudo ufw status verbose\n\n# Reset all rules\nsudo ufw reset\n```\n\n### macOS firewall\n\n```bash\n# Check status\nsudo \u002Fusr\u002Flibexec\u002FApplicationFirewall\u002Fsocketfilterfw --getglobalstate\n\n# Enable\nsudo \u002Fusr\u002Flibexec\u002FApplicationFirewall\u002Fsocketfilterfw --setglobalstate on\n\n# Allow an application\nsudo \u002Fusr\u002Flibexec\u002FApplicationFirewall\u002Fsocketfilterfw --add \u002Fusr\u002Flocal\u002Fbin\u002Fmyapp\n```\n\n## Proxy Configuration\n\n### Environment variables\n\n```bash\n# Set proxy for most CLI tools\nexport HTTP_PROXY=http:\u002F\u002Fproxy.example.com:8080\nexport HTTPS_PROXY=http:\u002F\u002Fproxy.example.com:8080\nexport NO_PROXY=localhost,127.0.0.1,.internal.example.com\n\n# For curl specifically\nexport http_proxy=http:\u002F\u002Fproxy.example.com:8080  # lowercase also works\n\n# With authentication\nexport HTTPS_PROXY=http:\u002F\u002Fuser:password@proxy.example.com:8080\n```\n\n### Test through proxy\n\n```bash\n# curl with explicit proxy\ncurl -x http:\u002F\u002Fproxy.example.com:8080 https:\u002F\u002Fhttpbin.org\u002Fip\n\n# SOCKS proxy\ncurl --socks5 localhost:1080 https:\u002F\u002Fhttpbin.org\u002Fip\n\n# Verify your external IP through proxy\ncurl -x http:\u002F\u002Fproxy:8080 https:\u002F\u002Fhttpbin.org\u002Fip\ncurl https:\u002F\u002Fhttpbin.org\u002Fip  # Compare with direct\n\n# Test proxy connectivity\ncurl -v -x http:\u002F\u002Fproxy:8080 https:\u002F\u002Fexample.com 2>&1 | grep -i \"proxy\\|connect\"\n```\n\n### Common proxy issues\n\n```bash\n# Node.js fetch\u002Fundici does NOT respect HTTP_PROXY\n# Use undici ProxyAgent or node-fetch with http-proxy-agent\n\n# Git through proxy\ngit config --global http.proxy http:\u002F\u002Fproxy:8080\ngit config --global https.proxy http:\u002F\u002Fproxy:8080\n# Remove:\ngit config --global --unset http.proxy\n\n# npm through proxy\nnpm config set proxy http:\u002F\u002Fproxy:8080\nnpm config set https-proxy http:\u002F\u002Fproxy:8080\n\n# pip through proxy\npip install --proxy http:\u002F\u002Fproxy:8080 package-name\n```\n\n## Certificate Troubleshooting\n\n```bash\n# Check certificate from a server\necho | openssl s_client -connect example.com:443 -servername example.com 2>\u002Fdev\u002Fnull | \\\n  openssl x509 -noout -subject -issuer -dates\n\n# Check expiry\necho | openssl s_client -connect example.com:443 2>\u002Fdev\u002Fnull | \\\n  openssl x509 -noout -enddate\n\n# Download certificate chain\nopenssl s_client -showcerts -connect example.com:443 \u003C \u002Fdev\u002Fnull 2>\u002Fdev\u002Fnull | \\\n  awk '\u002FBEGIN CERT\u002F,\u002FEND CERT\u002F' > chain.pem\n\n# Verify a certificate against CA bundle\nopenssl verify -CAfile \u002Fetc\u002Fssl\u002Fcerts\u002Fca-certificates.crt server.pem\n\n# Check certificate for a specific hostname (SNI)\nopenssl s_client -connect cdn.example.com:443 -servername cdn.example.com\n\n# Common error: \"certificate has expired\"\n# Check the date on the server:\ndate\n# If the system clock is wrong, certs will appear invalid\n```\n\n## Quick Diagnostics Script\n\n```bash\n#!\u002Fbin\u002Fbash\n# net-check.sh — Quick network diagnostics\nTARGET=\"${1:?Usage: net-check.sh \u003Chostname> [port]}\"\nPORT=\"${2:-443}\"\n\necho \"=== Network Check: $TARGET:$PORT ===\"\n\necho -n \"DNS resolution: \"\nIP=$(dig +short \"$TARGET\" | head -1)\n[[ -n \"$IP\" ]] && echo \"$IP\" || echo \"FAILED\"\n\necho -n \"Ping: \"\nping -c 1 -W 3 \"$TARGET\" > \u002Fdev\u002Fnull 2>&1 && echo \"OK\" || echo \"FAILED (may be blocked)\"\n\necho -n \"Port $PORT: \"\nnc -zv -w 5 \"$TARGET\" \"$PORT\" 2>&1 | grep -q \"succeeded\\|open\" && echo \"OPEN\" || echo \"CLOSED\u002FFILTERED\"\n\nif [[ \"$PORT\" == \"443\" || \"$PORT\" == \"8443\" ]]; then\n    echo -n \"TLS: \"\n    echo | openssl s_client -connect \"$TARGET:$PORT\" -servername \"$TARGET\" 2>\u002Fdev\u002Fnull | \\\n      grep -q \"Verify return code: 0\" && echo \"VALID\" || echo \"INVALID\u002FERROR\"\n\n    echo -n \"Certificate expiry: \"\n    echo | openssl s_client -connect \"$TARGET:$PORT\" 2>\u002Fdev\u002Fnull | \\\n      openssl x509 -noout -enddate 2>\u002Fdev\u002Fnull | sed 's\u002FnotAfter=\u002F\u002F'\nfi\n\necho \"=== Done ===\"\n```\n\n## Tips\n\n- `dig +short` is the fastest way to check DNS from the command line. Use `@8.8.8.8` to bypass local caching.\n- `nc -zv` is the simplest port connectivity test. If nc isn't available, use bash's `\u002Fdev\u002Ftcp`.\n- curl's `-w` format string with timing variables is the fastest way to diagnose slow HTTP requests: DNS, connect, TLS, and TTFB are all visible.\n- DNS changes propagate based on TTL. Check the current TTL with `dig` before expecting a DNS change to take effect.\n- `\u002Fetc\u002Fhosts` changes take effect immediately (no TTL, no propagation delay). Use it to test domain migrations before changing DNS.\n- When debugging \"connection refused\": first verify the port is open with `nc`, then check the service is actually listening with `ss -tlnp` or `lsof -i`.\n- `mtr` is better than `traceroute` for diagnosing packet loss — it runs continuously and shows per-hop loss percentages.\n- Node.js, Python `requests`, and many libraries do NOT automatically use `HTTP_PROXY` environment variables. Check each tool's proxy documentation.\n",{"name":5,"metadata":53,"description":7},{"clawdbot":54},{"os":55,"emoji":56,"requires":57},[47,32,43],"?",{"anyBins":58},[59,60,61,62,63],"dig","nslookup","curl","ping","nc","main","f4cb2d49f7667e79ef7804f50396d5aaffdf1f56","代码质量与测试\u002Fdns-networking",1,"https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification","https:\u002F\u002Fgithub.com\u002FKernel8901","a little little little dobe in life but science geek","2026-04-05 16:43:56",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add Kernel8901\u002Fai-agent-skills-classification --skill dns-networking",{"tool":78,"command":79},"bunx","bunx skills add Kernel8901\u002Fai-agent-skills-classification --skill dns-networking",{"tool":81,"command":82},"pnpm","pnpm dlx skills add Kernel8901\u002Fai-agent-skills-classification --skill dns-networking","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F代码质量与测试\u002Fdns-networking\u002FSKILL.md",true,[86],{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"_meta.json","REFERENCE","参考文档",294,"https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F代码质量与测试\u002Fdns-networking\u002F_meta.json",[93,116,146,157,167,197],{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":48},"01M6Q5R6WZ06RRB9RQTW54B34B","zyfai","Earn yield on any Ethereum wallet on Base, Arbitrum, and Plasma. Use when a user wants passive DeFi yield on their funds. Deploys a non-custodial subaccount (Safe) linked to their EOA, enables automated yield optimization, and lets them deposit\u002Fwithdraw anytime.","https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F金融\u002Fzyfai-sdk\u002FSKILL.md",[],[95,100,101,102,103,104,36,105,106,107,108,109,110,111,112,113,114,115],"safe","ethereum","defi","Optimization","user","Wallet","base","deposit","withdraw","yield","arbitrum","non-custodial","passive","defi yield","earn","yield optimization",{"skillNo":117,"name":118,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":128,"publishedAt":48},"01M6Q5R337B5JSNER4P4YS03TN","zerion-api","https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F金融\u002Fzerion-api\u002FSKILL.md",[121,124,127],{"categoryNo":122,"categoryName":123,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":125,"categoryName":126,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":23,"categoryName":24,"taxonomyType":25,"taxonomyTypeDesc":26},[129,130,131,132,133,134,135,102,136,105,137,138,139,140,141,142,143,144,145],"api","zerion api","zerion","MCP","mcp server","server","blockchain","transactions","crypto wallet","crypto","evm","solana","query","across","positions","token","prices",{"skillNo":147,"name":148,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":154,"publishedAt":48},"01M6Q5QZFYTDAZMZ27BN5VZXAR","zerion-api-skill","https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F金融\u002Fzerion-api-skill\u002FSKILL.md",[151,152,153],{"categoryNo":122,"categoryName":123,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":125,"categoryName":126,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":23,"categoryName":24,"taxonomyType":25,"taxonomyTypeDesc":26},[129,155,156,130,131,132,133,134,135,102,136,105,138,139,140,141,142,143,144,145],"api skill","zerion api skill",{"skillNo":158,"name":159,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":165,"publishedAt":48},"01M6Q5QW17QW98RA3FE45E4RD8","zerion-api-mcp","https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F金融\u002Fzerion-api-mcp\u002FSKILL.md",[162,163,164],{"categoryNo":122,"categoryName":123,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":125,"categoryName":126,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":23,"categoryName":24,"taxonomyType":25,"taxonomyTypeDesc":26},[132,129,166,130,131,133,134,102,136,105,137,138,139,140,141,142,143,144,145],"zerion api mcp",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":176,"publishedAt":48},"01M6Q5QQYZB7A501BDEQWKGSJT","yahoo-finance-forex","Fetches real-time FOREX news and market data from Yahoo Finance for major currency pairs (EUR\u002FUSD, GBP\u002FUSD, USD\u002FJPY, etc.). Analyzes sentiment and provides trading context.","https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F金融\u002Fyahoo-finance-forex\u002FSKILL.md",[173],{"categoryNo":174,"categoryName":175,"taxonomyType":25,"taxonomyTypeDesc":26},"01JBSEEDCAT000000000000040","财务",[177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196],"finance","yahoo finance","forex","yahoo","yahoo finance forex","github","https","sentiment","real-time","python3","install","Market","usd","news","time","currency","gbp","pip","market data","for",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":204,"publishedAt":48},"01M6Q5QM6VS84WZVM7BKXXPF32","yahoo-finance","This skill should be used when the user asks to \"get stock prices\", \"check stock quotes\", \"look up earnings\", \"get financial data\", \"find trending stocks\", or needs stock market data from Yahoo Finance.","https:\u002F\u002Fgithub.com\u002FKernel8901\u002Fai-agent-skills-classification\u002Fblob\u002Fmain\u002F金融\u002Fyahoo-finance-cli\u002FSKILL.md",[203],{"categoryNo":174,"categoryName":175,"taxonomyType":25,"taxonomyTypeDesc":26},[177,178,180,205,206,207,208,209,210,188,211,212,213,214,215,216,217,218,145,195],"cli","homebrew","find","check","brew","up","local","get","stock","link","trending","sf","quotes","ln"]