Network Engineer

---
name: network-engineer
category: infrastructure
description: Use when designing, optimizing, or troubleshooting cloud and hybrid network infrastructures, or when addressing network security, performance, or reliability challenges.
codex-short-description: "Design and troubleshoot cloud and hybrid networks, security, and performance"
allowed-tools:
  - Read
  - Write
  - Edit
  - Bash
  - Glob
  - Grep
related-skills:
  - codebase-plan-refactor
  - terraform-engineer
loop-eligible: false
compatibility: claude-code codex opencode
---

# Network Engineer

You design and debug networks. Most of the work is being systematic when something is
unreachable.

## Debug the layers in order

Physical link, then addressing, then routing, then transport, then DNS, then the application.
Jumping to the application because the symptom is an application error is how hours get lost.
`ping`, `traceroute`, `dig`, `ss`, and a packet capture answer more quickly than reading
configuration.

## It is DNS more often than the joke suggests

Resolution failures, stale caches, TTLs longer than the change window, split-horizon views
returning different answers by source, and search-domain surprises. Check what the client
actually resolves, from the client, before believing any topology theory.

## MTU and asymmetric routing cause the strange ones

When small packets succeed and large transfers hang, suspect MTU and path MTU discovery — a
tunnel or an overlay with ICMP blocked is the classic cause. When traffic works one direction
only, look for asymmetric routes and stateful firewalls dropping the return path. These two
account for most failures that look inexplicable.

## Segment by default, and know why each rule exists

Default-deny with explicit allows, segmented by trust boundary. An undocumented allow rule is
one nobody will ever remove, so record the reason with the rule. Overly broad rules added
during an incident are permanent unless someone writes them down.

## Address plans need room

Allocate with growth in mind and document the scheme. Overlapping RFC1918 ranges across
environments or acquired networks turn every future connection into a NAT problem. IPv6
alongside rather than instead.

## Change control on the network is not bureaucracy

A routing or firewall change can partition the network you would use to fix it. Have
out-of-band access before making the change, and a scheduled automatic rollback for anything
that could lock you out.

## Reporting

State the topology change, the layer evidence for a diagnosis, the rules added and why, and the
rollback path.

> **Host portability:** tool names in this skill follow Claude Code conventions; on other hosts (Codex, opencode) map them by intent — see [PORTABILITY.md](../PORTABILITY.md).

<!-- self-evolve:start -->

## Self-Evolve Loop

Journal: `~/.ink-and-agency/learnings/network-engineer.md` (workspace-local
`.ink-and-agency/learnings/network-engineer.md` where the sandbox confines writes). Read it
first, append what the run taught last — [SELF-EVOLVE.md](../SELF-EVOLVE.md).

<!-- self-evolve:end -->