Skip to main content
Glama

run_traceflow

Trace a packet's path through NSX overlay to identify which DFW rule drops a flow, returning hop-by-hop observations and operation state.

Instructions

[WRITE] Run a Traceflow to trace a packet's path through the NSX overlay.

Injects a synthetic probe from the source port. Returns traceflow_id, operation_state (IN_PROGRESS / FINISHED / FAILED) and hop-by-hop observations typed by resource_type; Dropped* ones carry reason and acl_rule_id. Use it to find which DFW rule drops a flow, then get_dfw_rule_stats on that rule. A FINISHED traceflow is deleted server-side and its id 404s; only one still IN_PROGRESS at timeout_seconds survives for get_traceflow_result to poll.

Args: src_lport_id: Source logical port ID — the VM NIC attachment UUID. This skill does not enumerate ports; run vmware-nsx's get_segment_port_for_vm to obtain one. src_ip: Probe source IP. dst_ip: Destination IP. protocol: TCP, UDP or ICMP (default TCP). dst_port: Destination port for TCP/UDP (default 80). src_port: Source port for TCP/UDP (default 1234). ttl: IP TTL (default 64). timeout_seconds: Max seconds to wait (default 20). target: Optional NSX Manager target from config.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
ttlNo
dst_ipYes
src_ipYes
targetNo
dst_portNo
protocolNoTCP
src_portNo
src_lport_idYes
timeout_secondsNo
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses important lifecycle behavior beyond annotations: a FINISHED traceflow is deleted server-side and its ID 404s, only an IN_PROGRESS traceflow survives polling. Also explains return states and observation types. This adds significant context beyond readOnlyHint=false and destructiveHint=false.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the purpose, then organizes details and Args in a clear structure. Every sentence adds value—probe injection, return types, deletion behavior, and parameter explanations—with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 9 parameters, no output schema, and no enums, the description provides complete operational context: expected return values, lifecycle, prerequisites, and companion tools. Nothing critical is missing for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description fully compensates by explaining all 9 parameters in the Args section, including the source port ID's UUID nature and how to obtain it. Adds protocol values, defaults, and the meaning of timeout_seconds, going far beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Run a Traceflow to trace a packet's path through the NSX overlay.' It explicitly distinguishes itself from siblings like get_dfw_rule_stats and get_traceflow_result by stating its role in the DFW troubleshooting flow.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use this tool ('Use it to find which DFW rule drops a flow') and points to an alternative for port enumeration ('run vmware-nsx's get_segment_port_for_vm to obtain one'). Also references get_traceflow_result for polling, providing clear context for follow-up actions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/vmware-skills/VMware-NSX-Security'

If you have feedback or need assistance with the MCP directory API, please join our Discord server