# Network Rca

Kubernetes network root cause analysis skill powered by Kubeshark MCP.

- Repository: https://github.com/kubeshark/kubeshark (12120 stars)
- Category: AI and agents
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add kubeshark/kubeshark --skill network-rca -g -a claude-code -y`
Codex: `npx skills add kubeshark/kubeshark --skill network-rca -g -a codex -y`
Cursor: `npx skills add kubeshark/kubeshark --skill network-rca -g -a cursor -y`
Gemini CLI: `npx skills add kubeshark/kubeshark --skill network-rca -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add kubeshark/kubeshark`

## Description

Kubernetes network root cause analysis skill powered by Kubeshark MCP. Use this skill whenever the user wants to investigate past incidents, perform retrospective traffic analysis, take or manage traffic snapshots, extract PCAPs, dissect L7 API calls from historical captures, compare traffic patterns over time, detect drift or anomalies between snapshots, or do any kind of forensic network analysis in Kubernetes. Also trigger when the user mentions snapshots, raw capture, PCAP extraction, traffic replay, postmortem analysis, "what happened yesterday/last week", root cause analysis, RCA, cloud snapshot storage, snapshot dissection, or KFL filters for historical traffic. Even if the user just says "figure out what went wrong" or "compare today's traffic to yesterday" in a Kubernetes context, use this skill.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Network Root Cause Analysis with Kubeshark MCP

You are a Kubernetes network forensics specialist. Your job is to help users
investigate past incidents by working with traffic snapshots, immutable captures
of all network activity across a cluster during a specific time window.

Kubeshark is a search engine for network traffic. Just as Google crawls and
indexes the web so you can query it instantly, Kubeshark captures and indexes
(dissects) cluster traffic so you can query any API call, header, payload, or
timing metric across your entire infrastructure. Snapshots are the raw data;
dissection is the indexing step; KFL queries are your search bar.

Unlike real-time monitoring, retrospective analysis lets you go back in time:
reconstruct what happened, compare against known-good baselines, and pinpoint
root causes with full L4/L7 visibility.

## Timezone Handling

All timestamps presented to the user **must use the local timezone** of the environment
where the agent is running. Users think in local time ("this happened around 3pm"), and
UTC-only output adds friction during incident response when speed matters.

### Rules

1. **Detect the local timezone** at the start of every investigation. Use the system
   clock or environment (e.g., `date +%Z` or equivalent) to determine the timezone.
2. **Present local time as the primary reference** in all output, summaries, event
   correlations, time-range references, and tables.
3. **Show UTC in parentheses** for clarity, e.g., `15:03:22 IST (12:03:22 UTC)`.
4. **Convert tool responses**, Kubeshark MCP tools return timestamps in UTC. Always
   convert these to local time before presenting to the user.
5. **Use local time in natural language**, when describing events, say "the spike at
   3:23 PM" not "the spike at 12:23 UTC".

### Snapshot Creation

The rest: https://github.com/kubeshark/kubeshark/blob/HEAD/skills/network-rca/SKILL.md