Network Engineering Skill

Network Engineering

Comprehensive network engineering skill covering network design, troubleshooting, load balancing, DNS, and network security.

When to Use This Skill

Designing network topologies
Troubleshooting connectivity issues
Configuring load balancers
DNS configuration and troubleshooting
SSL/TLS setup and debugging
Network security implementation
Performance optimization
CDN configuration

Network Architecture

OSI Model Reference

| Layer | Name | Protocols | Troubleshooting | |-------|------|-----------|-----------------| | 7 | Application | HTTP, DNS, SMTP | curl, browser tools | | 6 | Presentation | SSL/TLS | openssl | | 5 | Session | NetBIOS | - | | 4 | Transport | TCP, UDP | netstat, ss | | 3 | Network | IP, ICMP | ping, traceroute | | 2 | Data Link | Ethernet | arp | | 1 | Physical | - | cable tester |

VPC/Network Design

Subnet Strategy:

VPC CIDR: 10.0.0.0/16 (65,536 IPs)

Public Subnets (internet-facing):
  - 10.0.1.0/24 (AZ-a) - Load balancers, bastion
  - 10.0.2.0/24 (AZ-b)
  - 10.0.3.0/24 (AZ-c)

Private Subnets (application tier):
  - 10.0.11.0/24 (AZ-a) - App servers
  - 10.0.12.0/24 (AZ-b)
  - 10.0.13.0/24 (AZ-c)

Database Subnets (isolated):
  - 10.0.21.0/24 (AZ-a) - Databases only
  - 10.0.22.0/24 (AZ-b)
  - 10.0.23.0/24 (AZ-c)

Traffic Flow:

Internet → Load Balancer (public) → App (private) → DB (isolated)
NAT Gateway for private subnet outbound
VPC Endpoints for AWS services

Load Balancing

Load Balancer Types

| Type | Layer | Use Case | |------|-------|----------| | Application (ALB) | 7 | HTTP/HTTPS, path routing | | Network (NLB) | 4 | TCP/UDP, static IP, high performance | | Classic | 4/7 | Legacy | | Gateway | 3 | Third-party appliances |

Health Checks

# ALB Health Check
health_check:
  path: /health
  protocol: HTTP
  port: 8080
  interval: 30
  timeout: 5
  healthy_threshold: 2
  unhealthy_threshold: 3
  matcher: "200-299"

Routing Strategies

Round Robin: Equal distribution
Least Connections: Route to least busy
IP Hash: Sticky sessions by client IP
Weighted: Percentage-based distribution
Path-based: Route by URL path
Host-based: Route by hostname

DNS

Record Types

| Type | Purpose | Example | |------|---------|---------| | A | IPv4 address | example.com → 192.0.2.1 | | AAAA | IPv6 address | example.com → 2001:db8::1 | | CNAME | Alias | www → example.com | | MX | Mail server | example.com → mail.example.com | | TXT | Arbitrary text | SPF, DKIM, verification | | NS | Name server | DNS delegation | | SRV | Service location | _sip._tcp.example.com | | CAA | Certificate authority | Restrict CA issuance |

DNS Debugging

# Query specific record type
dig example.com A
dig example.com MX
dig example.com TXT

# Query specific DNS server
dig @8.8.8.8 example.com

# Trace DNS resolution
dig +trace example.com

# Check propagation
dig +short example.com @{dns-server}

TTL Strategy

| Record Type | Recommended TTL | |-------------|-----------------| | Static content | 86400 (1 day) | | Dynamic content | 300 (5 min) | | Failover records | 60 (1 min) | | Pre-migration | Lower to 60 |

SSL/TLS

Certificate Types

| Type | Validation | Use Case | |------|------------|----------| | DV | Domain ownership | Basic sites | | OV | Organization verified | Business sites | | EV | Extended validation | High-trust sites | | Wildcard | *.domain.com | Multiple subdomains | | SAN | Multi-domain | Multiple specific domains |

TLS Configuration

Recommended Settings:

TLS 1.2 and 1.3 only
Strong cipher suites (AEAD)
HSTS enabled
OCSP stapling
Certificate transparency

Debugging SSL

# Check certificate
openssl s_client -connect example.com:443 -servername example.com

# Check certificate chain
openssl s_client -connect example.com:443 -showcerts

# Check expiration
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

# Test TLS versions
openssl s_client -connect example.com:443 -tls1_2
openssl s_client -connect example.com:443 -tls1_3

Troubleshooting

Connectivity Checklist

Physical/Cloud layer: Is the instance running?
Security groups: Are ports open?
NACLs: Are subnets allowing traffic?
Route tables: Is routing correct?
DNS: Does name resolve?
Application: Is service listening?

Common Commands

# Check if port is listening
netstat -tlnp | grep :80
ss -tlnp | grep :80

# Test TCP connectivity
nc -zv hostname 443
telnet hostname 443

# Check routes
ip route
traceroute hostname
mtr hostname

# DNS resolution
nslookup hostname
dig hostname
host hostname

# Network interfaces
ip addr
ifconfig

# Active connections
netstat -an
ss -tuln

Performance Debugging

# Bandwidth test
iperf3 -c server-ip

# Latency analysis
ping -c 100 hostname | tail -1

# MTU issues
ping -M do -s 1472 hostname

# Packet capture
tcpdump -i eth0 port 443

Reference Files

references/troubleshooting.md - Detailed troubleshooting workflows

Integration with Other Skills

cloud-infrastructure - For cloud networking
security-engineering - For network security
performance - For network optimization

Agent Skills: Network Engineering

Install this agent skill to your local

Skill Files