# US 10,313,205 B2 · Context-sensitive command whitelisting for centralized troubleshooting tool > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,205 B2 - Document ID: US10313205B2 - Status: Granted - Kind: B2 - Application number: 15/389,158 - Filed: 2016-12-22 - Published: 2018-01-04 - Granted: 2019-06-04 - Earliest claimed: 2016-06-29 - Assignees: Nicira, Inc. - Applicants: Nicira, Inc. - Inventors: Chidambareswaran Raman; Akhila Naveen; Raju Koganty - Web page: https://patentgrep.com/patent/US10313205B2 ## CPC - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - G06F 11/00: Error detection; Error correction; Monitoring (error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00) - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 11/3051: {Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs (verification or detection of system hardware configuration G06F11/2247)} - G06F 11/3433: {for load management (allocation of a server based on load conditions G06F9/505; load rebalancing G06F9/5083; redistributing the load in a network by a load balancer H04L67/1029)} - H04L 41/044: comprising hierarchical management structures - H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities - G06F 2201/815: Virtual - H04L 41/0856: {by backing up or archiving configuration information} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Some embodiments provide a method for troubleshooting a virtual network that is implemented across a plurality of computing devices. The method provides a command line interface (CLI) for receiving and executing commands for debugging and monitoring the virtual network. Each command is for communicating with a set of the computing devices in order to monitor a network service being provided by the set of computing devices. The CLI operates in multiple different contexts for monitoring multiple different types of network services. While the CLI is operating in a particular context for a particular type of network service, the method receives a command comprising a set of identifiers. The method determines the validity of the received command under the particular context. When the received command is valid under the particular context, the method transmits data to a computing device identified by the received command. ## Claims ### Claim 1 A method for troubleshooting a virtual network that is implemented across a plurality of computing devices, the method comprising: providing a command line interface (CLI) for receiving and executing commands for debugging and monitoring the virtual network, each command for communicating with a set of the computing devices in order to monitor a network service being provided by the set of computing devices, wherein the CLI operates in a plurality of different contexts for monitoring a plurality of different types of network services and each different context recognizes a group of identifiers associated with the context; while the CLI is operating in a particular context for a particular type of network service, receiving a command comprising a set of identifiers; determining a validity of the received command under the particular context by determining whether the command comprises at least one identifier that is not in the group of identifiers recognized by the particular context; and when the received command is valid under the particular context, transmitting data to a computing device identified by the received command. ### Claim 2 (depends on 1) The method of claim 1, wherein the network service is a distributed firewall implemented by multiple computing devices of the virtual network. ### Claim 3 (depends on 1) The method of claim 1, wherein the network service is a distributed load-balancer implemented by multiple computing devices of the virtual network. ### Claim 4 (depends on 1) The method of claim 1, wherein the plurality of contexts comprises a logical switch context, a logical router context, a distributed firewall context, a distributed load balancer context, and an edge context. ### Claim 5 A method for troubleshooting a virtual network that is implemented across a plurality of computing devices, the method comprising: providing a command line interface (CLI) for receiving and executing commands for debugging and monitoring the virtual network, each command for communicating with a set of the computing devices in order to monitor a network service being provided by the set of computing devices, wherein (i) the CLI operates in a plurality of different contexts for monitoring a plurality of different types of network services and (ii) each context is associated with its own set of accepted syntax elements; while the CLI is operating in a particular context for a particular type of network service, receiving a command comprising a set of identifiers; determining a validity of the received command under the particular context by determining whether the command comprises at least one syntax element that is not in the accepted set of syntax elements of the particular context; and when the received command is valid under the particular context, transmitting data to a computing device identified by the received command. ### Claim 6 (depends on 5) The method of claim 5, wherein the plurality of computing devices comprises host machines that host virtual machines (VMs), each VM interfacing the virtual network through a set of virtual network interface controllers (VNICs), wherein at least some of the network services are implemented at the VNICs of the host machines. ### Claim 7 (depends on 5) The method of claim 5, wherein the network service is one of (i) a distributed firewall implemented by multiple computing devices of the virtual network and (ii) a distributed load-balancer implemented by multiple computing devices of the virtual network. ### Claim 8 A non-transitory machine readable medium storing a program which when executed by at least one processing unit troubleshoots a virtual network that is implemented across a plurality of computing devices, the program comprising sets of instructions for: providing a command line interface (CLI) for receiving and executing commands for debugging and monitoring the virtual network, each command for communicating with a set of the computing devices in order to monitor a network service being provided by the set of computing devices, wherein the CLI operates in a plurality of different contexts for monitoring a plurality of different types of network services and each different context recognizes a group of identifiers associated with the context; while the CLI is operating in a particular context for a particular type of network service, receiving a command comprising a set of identifiers; determining a validity of the received command under the particular context by determining whether the command comprises at least one identifier that is not in the group of identifiers recognized by the particular context; and when the received command is valid under the particular context, transmitting data to a computing device identified by the received command. ### Claim 9 (depends on 8) The non-transitory machine readable medium of claim 8, wherein the network service is a distributed firewall implemented by multiple computing devices of the virtual network. ### Claim 10 (depends on 8) The non-transitory machine readable medium of claim 8, wherein the network service is a distributed load-balancer implemented by multiple computing devices of the virtual network. ### Claim 11 A non-transitory machine readable medium storing a program which when executed by at least one processing unit troubleshoots a virtual network that is implemented across a plurality of computing devices, the program comprising sets of instructions for: providing a command line interface (CLI) for receiving and executing commands for debugging and monitoring the virtual network, each command for communicating with a set of the computing devices in order to monitor a network service being provided by the set of computing devices, wherein the CLI operates in a plurality of different contexts for monitoring a plurality of different types of network services, the plurality of different contexts comprising a logical switch context, a logical router context, a distributed firewall context, a distributed load balancer context, and an edge context; while the CLI is operating in a particular context for a particular type of network service, receiving a command comprising a set of identifiers; determining a validity of the received command under the particular context; and when the received command is valid under the particular context, transmitting data to a computing device identified by the received command. ### Claim 12 (depends on 11) The non-transitory machine readable medium of claim 11, wherein the plurality of computing devices comprises host machines that host virtual machines (VMs), each VM interfacing the virtual network through a set of virtual network interface controllers (VNICs), wherein at least some of the network services are implemented at the VNICs of the host machines. ### Claim 13 A non-transitory machine readable medium storing a program which when executed by at least one processing unit troubleshoots a virtual network that is implemented across a plurality of computing devices, the program comprising sets of instructions for: providing a command line interface (CLI) for receiving and executing commands for debugging and monitoring the virtual network, each command for communicating with a set of the computing devices in order to monitor a network service being provided by the set of computing devices, wherein (i) the CLI operates in a plurality of different contexts for monitoring a plurality of different types of network services, and (ii) each context is associated with its own set of accepted syntax elements; while the CLI is operating in a particular context for a particular type of network service, receiving a command comprising a set of identifiers; determining a validity of the received command under the particular context by determining whether the command comprises at least one syntax element that is not in the accepted set of syntax elements of the particular context; and when the received command is valid under the particular context, transmitting data to a computing device identified by the received command. ### Claim 14 (depends on 13) The non-transitory machine readable medium of claim 13, wherein the network service is one of (i) a distributed firewall implemented by multiple computing devices of the virtual network and (ii) a distributed load-balancer implemented by multiple computing devices of the virtual network. ### Claim 15 A method for troubleshooting a virtual network implemented across a plurality of computing devices, the method comprising: providing a command line interface (CLI) for receiving and executing commands for debugging and monitoring the virtual network, each command for communicating with a set of the computing devices in order to monitor a network service being provided by the set of computing devices, wherein the CLI operates in a plurality of different contexts for monitoring a plurality of different types of network services; and retrieving a set of sample commands, comprising a history of previously executed commands at the CLI, for a particular one of the contexts from a storage that stores a plurality of sample commands for the plurality of different contexts, wherein said retrieving comprises identifying and excluding commands that are incompatible with the particular context. ### Claim 16 (depends on 15) The method of claim 15, wherein the set of sample commands further comprises a set of preloaded commands provided by a configuration file of the CLI. ### Claim 17 A method for troubleshooting a virtual network implemented across a plurality of computing devices, the method comprising: providing a command line interface (CLI) for receiving and executing commands for debugging and monitoring the virtual network, each command for communicating with a set of the computing devices in order to monitor a network service being provided by the set of computing devices, wherein the CLI operates in a plurality of different contexts for monitoring a plurality of different types of network services; and retrieving, from a storage that stores a plurality of sample commands for the plurality of different contexts, a set of sample commands for a particular one of the contexts that is associated with a listing of recognized identifiers, wherein said retrieving comprises (i) identifying an incompatible command by identifying commands having an identifier that is not in the listing of recognized identifiers and (ii) excluding commands that are incompatible with the particular context. ### Claim 18 (depends on 17) The method of claim 17, wherein the plurality of contexts comprises a logical switch context, a logical router context, a distributed firewall context, a distributed load balancer context, and an edge context. ### Claim 19 A method for troubleshooting a virtual network implemented across a plurality of computing devices, the method comprising: providing a command line interface (CLI) for receiving and executing commands for debugging and monitoring the virtual network, each command for communicating with a set of the computing devices in order to monitor a network service being provided by the set of computing devices, wherein the CLI operates in a plurality of different contexts for monitoring a plurality of different types of network services; and retrieving, from a storage that stores a plurality of sample commands for the plurality of different contexts, a set of sample commands for a particular one of the contexts that is associated with a set of accepted syntax elements, wherein said retrieving comprises (i) identifying an incompatible command by identifying commands having at least one syntax element that is not in the accepted set of syntax elements and (ii) excluding commands that are incompatible with the particular context. ### Claim 20 (depends on 19) The method of claim 19, wherein the plurality of contexts comprises a logical switch context, a logical router context, a distributed firewall context, a distributed load balancer context, and an edge context.