Network Doctor

This skill runs evidence-first network diagnostics and optimization on macOS, starting with read-only measurements of speed, latency, jitter, and DNS performance. It protects VPN and proxy services by default, proposing only reversible changes like DNS A/B tests, service reordering, or AWDL toggling before applying them. Use it to identify bottlenecks in link quality, bufferbloat, DNS instability, or background traffic, then verify improvements with before-and-after measurements.

Tunnel Doctor isolates and resolves conflicts when Tailscale coexists with proxy/VPN tools like Shadowrocket, Clash, or Surge on macOS. It addresses route table corruption, environment variable misconfigurations, system proxy bypass issues, SSH double-tunneling, and VM/container proxy propagation problems—covering scenarios from browser 503 errors to Docker timeouts and WSL SSH access.

This skill helps you troubleshoot connection problems with Windows App, Azure Virtual Desktop, and direct PC connections on macOS. It guides you through identifying whether your connection is using optimal UDP Shortpath or falling back to slower WebSocket transport, checks for VPN or proxy interference, and parses Windows App logs to uncover auth failures or protocol negotiation issues.

This skill guides you through building production-grade network infrastructure for self-hosted environments. It covers VLAN segmentation by trust level, firewall configuration across nftables, OPNsense, and pfSense, DNS architecture with Pi-hole and AdGuard Home, reverse proxies like Caddy and Traefik, VPN setup with WireGuard and Tailscale, certificate automation, and security hardening patterns. Use it whenever you're designing, implementing, or troubleshooting network topology, access control, or encrypted communications.

This skill applies falsification-first methodology to network and streaming incidents where the obvious cause is likely a red herring. Rather than stacking assumptions, it guides you through layered isolation—testing the same request across different paths to pinpoint exactly which hop (client, CDN, proxy, or backend) is responsible. Use it for connection resets, SSE stalls, fixed-time drops, certificate errors, or LAN mysteries where symptoms like "works sometimes" or "fails after N seconds" point to multiple possible layers.

A planning and validation framework for homelab network upgrades involving VLANs, local DNS resolvers, firewall rules, and remote access. Work through required inventory, trust zones, and staged migration steps to avoid locking yourself out of critical infrastructure. Includes safety rules, anti-patterns, and a review checklist to confirm your changes won't break management access or recovery paths.