The command external on starts VMD as a Tcl-DP RPC server. When an external process attempts to connect, the calling hostname is checked to see if it is allowed to run commands on the local machine. If so, the command is run. Note that external off does not disconnect currently attached processes, it only disallows new ones.
There is a simple security mechanism in the external command which derives from the standard Tcl-DP security. This allows or denies new connections based on the host name of the calling process and uses the command external host.
There are two ways to make a client that connects to VMD. The first is to use VMD itself. The command external connect <hostname> will connect to a VMD process on the given machine. The process that started the contact is the client VMD and the one that was contacted is the server VMD. The other way is to use a Tcl based shell which has Tcl-DP compiled in. Source (or look at) the file $env(VMDDIR)/scripts/vmd/external.tcl to see how the DP calls are made.
The client process sends a new command to the server with the command external send <command>.