Operate MIMIC Simulator in Plain English with Claude Code Skills

 

 

 

 

 

If you run MIMIC Simulator in your lab, you already know its interfaces: the MIMICview GUI, the WebUI, mimicsh, 

and the programming APIs. Now there is one more -- and it speaks your language. With the new MIMIC Skills for 

Claude Code, you state your intent in natural language (English, or any other):  for example "start agents 1-100 

with a warm-up delay", "why is throughput down since yesterday?", "zeige mir die aktivsten Agenten", "make 

agent 5 export IPFIX to my collector", ... Claude translates it into the right MIMIC API calls, runs them, and 

shows you exactly what it did.

 

1. What the Skills Are

 

Claude Code Skills are structured instruction packages that Claude reads at invocation time. The MIMIC skill

package turns Claude into a capable MIMIC operator by pairing an orchestrating skill with a bundled knowledge 

base of the MIMIC API surface and object model. The package currently contains three skills:

 

1. mimic -- the core operator skill: configuration, agent lifecycle, runtime simulation changes, troubleshooting --  

    any operation the installed MIMIC APIs expose;

 

2. mimic-diagnostics -- an add-on performance analyst: captures mimicd's built-in instrumentation over time and answers 

    "why is it slow, and what is the bottleneck?";

 

3. mimic-netflow -- an add-on flow-export operator: configures and drives NetFlow (v5/v9/v10-IPFIX) and sFlow sources on 

    your simulated agents, pointed at your collector.

The design goal is generality, not a fixed menu of workflows. Because the skill carries the API knowledge base 

rather than a list of canned recipes, it allows you to quickly become productive with MIMIC and handles any operations 

you may want to do.

 

2. Safe by Design

 

The skills are entirely optional and non-invasive. They require no changesto your MIMIC configuration, running processes, 

or workflows -- your installation behaves identically whether or not the skills are installed.

Key guarantees:

* Claude operates MIMIC only through its APIs -- it never edits files
   under the install area, never kills processes, even if asked;
 

* MIMIC remains multi-user: a colleague can drive the GUI, WebUI, or a
   CLI on the same instance at the same time, and the skill interoperates
   with state it did not create;
 

* inverse-action undo lets you back out of a change;
 

* an opt-in audit log keeps a durable record of everything the skill did.

 

3. Learn MIMIC by Watching

 

A secondary goal shaped the whole design: transparency. Every operation is echoed as the underlying API call before 

it runs, with a brief explanation, so you see not just the result but HOW it was done. Engineers new to a corner of 

MIMIC -- say, the flow-export configuration keys -- pick it up simply by watching the skill work. The skill is also aware 

of the MIMIC documentation, both your local install's help and the cloud docs, and presents the relevant pages on request.

 

4. Diagnose Performance in a Conversation

 

The mimic-diagnostics add-on shows what this looks like for a harder task. For example, instead of manually 

collecting profiling dumps and eyeballing counters, you say "profile the daemon for the next ten minutes and tell

me where the CPU is going." The skill:

 

* captures a time series of mimicd's built-in instrumentation (no daemon
   changes needed -- capturing is effectively read-only);

* reads each dump as rates and per-thread CPU against a model of mimicd's
   internal pipeline;
* reports the bottleneck -- throughput, latency, lock contention,
   per-request cost -- and compares against a known-good baseline if you
   have one.

 

5. Protocol Module expertise

Likewise, protocol specific skills like mimic-netflow turns a multi-step flow-export setup -- load the protocol 

module, attach a flow-source configuration, set the collector, enable, verify emission -- into one request: 

for example "have agent 12 export NetFlow v9 to 10.0.0.5:2055 and confirm the collector is receiving." 

The skill checks that the NetFlow module is loaded on your instance, walks the configuration through the
daemon's protocol commands, and verifies the session through statistics
and trace output.

 

Other protocol module expertise will be loadable on demand via the MIMIC Update Wizard.

6. Wrapping Up

The MIMIC Skills package adds a natural-language interface alongside the interfaces you already use -- 

one that executes your intent through the same APIs, shows its work, and leaves everything else untouched. For labs
already scripting MIMIC scenarios against Zabbix, Dynatrace, ElastiFlow, or LiveNX, this is the fastest 

path yet from "what I want to test" to a running simulation.

Contact us to try the MIMIC Skills for Claude Code in your environment.

MIMIC Simulator: Exercise threat detection in ElastiFlow

As we have seen before, MIMIC allows you to simulate network telemetry/flow exporter 

(e.g., NetFlow, IPFIX, sFlow) and SNMP agent of many virtual devices. You can fully customise 

the flow records and device behavior: e.g., set source/destination IPs, protocols, ports, 

packet/byte counts, export intervals, etc. You can manipulate the instrumentation 

of agent MIBs in the simulation in real-time: change MIB object values, add/remove MIB 

table entries, simulate traps, etc.

 

 

NetObserv is a network-flow and telemetry analytics platform: it ingests flows 

(NetFlow/IPFIX/sFlow) and SNMP/telemetry, normalises/enriches them, then provides 

dashboards, alerts, and security/operational analytics.  On the security side, NetObserv 

can detect things like port scans, unusual protocol usage, data exfiltration attempts, 

link saturation, routing anomalies, DDOS, among others.

When you combine the two tools, you get a controlled lab environment in which you can 

simulate threat-scenarios via MIMIC, and then ensure that your NetObserv setup detects 

them. Here’s how you can customise threat detection:

1. Simulate specific malicious/abnormal flows

Your flow source(s) will export flows for many ports, unusual source / destination combinations, 

unexpected protocol usage, high volume flows from internal to external, etc.

 

Your SNMP agents can simulate devices or network segments going into abnormal 

states via SNMP that might reflect threat behaviour (e.g., interface up/down, weird 

routing, high error rates).

 

Because you control every field in the flow record and instrumentation, you can test 

how NetObserv will behave if certain vendor-specific fields are present, or if flows are 

mal-formatted, or spoofed sources are used.

2. Configure NetObserv rules/analytics to catch your scenarios

Once the simulated flows appear in NetObserv, you can inspect how the detection logic 

(alerts, machine-learning models, anomaly detectors) handles them.

You can then fine-tune thresholds, detection logic, filters, enrichment settings so that your 

crafted malicious/abnormal flows trigger the appropriate alerts (or don’t trigger false positives).

For example: if you simulate “data exfiltration” flows (large outbound flows at odd hours 

to unknown destinations), you can validate that NetObserv flags those; if not, you adjust 

the detection rule.

Because you have full control of simulation, you can test edge cases: low-volume stealth 

exfiltration, internal lateral movement, scanning disguised as normal traffic, etc.

 

The following Youtube video shows this in 3 minutes:

 

 

 

Customize Zabbix with MIMIC Simulator

If you have a lab to test Zabbix prior to deployment, you can use MIMIC Simulator 

not just for monitoring, but also any operational customizations you’ve made (like triggers, 

escalations, actions, scripts, dashboards, etc.) without touching the production network. 

 

 Here’s how you can set it up and test systematically:

1. Define What You’re Testing

Operational customizations in Zabbix usually include:

• Triggers: thresholds, dependencies, recovery expressions
• Actions: notifications, escalations, scripts, integrations
• User roles: who gets what alerts, permissions
• Dashboards / Widgets: visualizations of problem states
• Custom items / discovery rules: SNMP, IPMI, JMX, or scripts

MIMIC gives you the data feed (SNMP, NetFlow, Syslog, MQTT, etc.) to exercise those.

2. Connect Zabbix to MIMIC

Configure MIMIC to simulate the network devices or servers Zabbix expects:

• SNMP agents (routers, switches, firewalls, servers) with custom MIBs
• Interfaces / traffic patterns for NetFlow/sFlow/IPFIX
• Syslog events for log-based monitoring
• Ping / ICMP / TCP services for availability checks

Point Zabbix to those MIMIC devices as if they were real.

3. Drive Scenarios in MIMIC

To test Zabbix customizations, you can script scenarios in MIMIC:

• Threshold violation

        Example: Raise interface utilization above 80% to trigger a Zabbix alert.

• Flapping conditions

        Oscillate values around the threshold to test hysteresis and trigger dependencies.

• Multiple-failure cascades

        Simulate a router outage that makes downstream devices unreachable, then

        see if your trigger dependencies suppress noise.

• Custom MIB objects

        Simulatr enterprise MIBs and vary them to trigger your Zabbix custom items.

• Logs/events

        Send specific syslog entries (e.g., authentication failure, hardware error) to test actions.

• High-volume scenarios

        Generate events from hundreds of devices to test scalability and load on Zabbix plus 

        your custom dashboards.

4. Verify Zabbix Customizations

As you run scenarios:

• Check whether triggers fire correctly (no false positives/negatives).
• Validate actions: did the right people get notified? Did escalation scripts run?
• Watch dashboards update in real time.
• Confirm permissions/roles: does each user see only what they should?
• Measure response time: does Zabbix handle bursts of simulated alerts as expected?

5. Automate Regression Testing

Because MIMIC is scriptable (via APIs and scenarios), you can build a test suite to run on-demand:

• Run a set of MIMIC-driven failures.
• Capture Zabbix responses (via API, audit logs, or UI checks).
• Compare against expected results.

This gives you a repeatable regression test bed for Zabbix customizations before 

deploying changes.

How a Simulator Like MIMIC Simulator Helps nGenius Customers

Netscout nGenius is a service assurance and performance management platform. 

It ingests NetFlow/IPFIX  and packets, metadata, and application-level information. 

Customers use it to monitor end-to-end service delivery, VoIP/UC quality, and application 

performance.

Common problems that customers can run into are:

1. High Data Rates – Full packet capture plus flows can overwhelm storage and analysis systems.

2. Service/Application Visibility Gaps – Correlating flows, packets, and user experience is complex.

3. Scalability and Cost – Packet-based monitoring requires very powerful hardware and lots of storage.

4. Multi-Vendor Complexity – Different devices export different flows/metadata.

5. Training & Troubleshooting – Staff need to learn how to interpret flow + packet data for root cause analysis.

6. Integration Challenges – Feeding nGenius data into ITSM/SIEM/SOC tools isn’t always straightforward.

    
   

 

 

 

MIMIC Simulator Suite virtualizes large network environments to help tackle some of these problems:

1. Validate Scale – Generate realistic traffic (flows + emulated devices) to see how nGenius handles high loads before production.

2. Application/Service Testing – Simulate voice, video, or application flows so teams can practice monitoring service quality.

3. Multi-Vendor Assurance – Emulate Cisco, Juniper, Palo Alto, etc. devices to test interoperability.

4. Training Lab – Give engineers real scenarios (DDoS, poor QoS, packet loss) without touching live users.

5. Safer Testing – Use simulated instrumentation data (SNMP, NetFlow, sFlow) instead of actual sensitive user data, avoiding compliance risks.

6. Integration Validation – Feed nGenius with reproducible test data to confirm workflows with SIEM, NMS, or service desks.
   

 

 

 

MIMIC Simulator and LiveNX

LiveNX customers can benefit from MIMIC Simulator to complement their in-house lab at a fraction of the cost of real equipment: 

 

Customize LiveNX

• Enables rapid development of custom features by recreating the exact scenario in MIMIC with repeatable test data.

• This makes development, troubleshooting and support faster and more precise.

   

Large-Scale Test Environments

• LiveNX is designed to monitor enterprise and service provider networks with thousands of devices and interfaces.

• With MIMIC, LiveNX customers can simulate tens of thousands of routers, switches, firewalls, and endpoints before deploying in production.

• This allows validation of LiveNX scalability without needing physical gear. Resources can be allocated well in advance to ensure smooth operations.
  

Figure 1 - Topology view with connections between sites

Training and Demos Without Real Hardware

• MIMIC can generate realistic SNMP responses from a variety of vendor devices and pathological scenarios, as well as NetFlow, sFlow, and syslog traffic.
  

• LiveNX teams can train staff and demonstrate LiveNX features using fully controlled, reproducible simulated environments — no need to access the live production network.

• Disaster preparation can be done safely in the simulated lab.

 

Figure 2 - Traffic breakdown for one of the connections

 

Network Change / Upgrade Validation

• Before rolling out firmware upgrades, new device models, or topology changes, LiveNX users can simulate the new environment in MIMIC.

• This ensures LiveNX’s discovery, topology visualization, and performance analytics work correctly ahead of time.

Proof-of-Concept (PoC) Acceleration

• Customers evaluating LiveNX can set up large testbeds overnight with MIMIC instead of waiting for lab hardware.

• This reduces time-to-value and makes the PoC process smoother.

MIMIC Simulator and Dynatrace

In our quest to support all possible network management platforms, we have

interoperated with Dynatrace by discovering large networks:

 

 

 

 

 

 

 

 

 

 

and drilling into devices:

MIMIC MQTT Lab: Test MQTT 5 support on AWS IoT Core

 AWS recently announced MQTT 5 support for AWS IoT.

We tested it in less than 5 minutes with MIMIC MQTT Lab AWS . You can do the same to make sure your
AWS IoT application uses the latest MQTT 5 features such as properties in PUBLISH messages, etc. 

Check the 2-minute Youtube video that shows the MQTT 5 CONNACK with new reason code:

CONNACK rc=0x00 Session Expiry Interval 0,Receive Maximum 100,Maximum QoS 1,Retain Available 1,Maximum Packet Size 149504,Topic Alias Maximum 8,Wildcard Subscription Available 1,Subscription Identifiers Available 0,Shared Subscription Available 1,Server Keep Alive 50

When we connect with the disallowed QOS 2, we get a new self-explanatory error code:

CONNACK rc=0x9b Reason String CONNACK:QOS 2 is not supported:861b3462-65d8-ba70-5472-63869294a5a1

and when we send a malformed PUBLISH (empty topic and topic alias):

INFO  12/02.10:53:07 - MQTT[AGT=3916] - sent CONNECT (51 bytes)
INFO  12/02.10:53:07 - MQTT[AGT=3916] - rcvd CONNACK rc=0x00 Session Expiry Interval 0,Receive Maximum 100,Maximum QoS 1,Retain Available 1,Maximum Packet Size 149504,Topic Alias Maximum 8,Wildcard Subscription Available 1,Subscription Identifiers Available 0,Shared Subscription Available 1,Server Keep Alive 50
INFO  12/02.10:53:08 - MQTT[AGT=3916] - sent PUBLISH (126 bytes)
INFO  12/02.10:53:08 - MQTT[AGT=3916] - rcvd DISCONNECT reason 0x82 (Reason String DISCONNECT:Data in packet does not conform to MQTT specification:19ec6dc1-0b50-888c-6c3e-3be26faee968)