Tuesday, August 18, 2026

From Empty Canvas to 10,000 Simulated Devices in Minutes

 
A network simulation worth testing against is more than just fifty devices in 
a row.  It should reflect your production network, usually consisting of a core, a
distribution layer, an access layer and the end  systems hanging off it -- each device
with the right interface count, each link connected to something real, and not one 
duplicated IP address anywhere in it. Built by hand that is days of data entry, and 
by the time the topology is right the thing you wanted to test has moved on.

If you have used the Topology Wizard in MIMIC Simulator, you already have most 
of this solved. Configuration->Auto builds a large topology from a description, 
Configuration->Manual connects ports one at a time, and Replicate stamps out
copies. The MIMIC Topology Designer is its successor, and the difference is what 
happens after generation.
 
The Wizard is a sequence of dialogs: you answer them, it produces a topology, and
to change anything you go back through the dialogs or edit connections one port at
a time. The Designer puts the whole topology on an interactive canvas.  Generation
is one thing you can do there, not the only thing.
 

 
 

Two ways to build: generate it, or draw it

Most large topologies start generated and end up edited, so the Topology Designer 
does both on the same canvas.
 
GENERATE. Describe the shape you want -- how many devices, how many levels, 
which device types at each level, and the address space to draw from -- and the 
Auto Topology Wizard builds it: agents created, interfaces wired, addresses 
assigned, laid out and ready to inspect. The device types come from the Device 
Library, so every generated agent arrives with the right simulation, scenario and 
interface set already on it.

DRAW. The canvas is where the rest of the work happens -- adjusting what was 
generated, or building what the generator has no shape for. Drag a device in to 
place it. Select one device and click another to link them. Change any agent's 
addressing, simulation or management interface afterwards and every connection
that depends on it follows.
 

Additionally, interactive connection of imported topologies allows Lego-style 
build-up of your simulated network.

Sanity-checking what you asked for

Three of the wizard's inputs are not independent of each other: the total device 
count, the number of levels, and the port density of the device types you assigned 
to each level. Together they decide whether the network you described can exist 
at all -- a shallow tree of four-port devices cannot hold ten thousand nodes no 
matter how firmly you type the number.

If the shape you specified cannot hold the count you asked for, generation does 
not start. You get the exact maximum that shape will hold, and four ways to 
change the answer: fewer devices, another level, higher-port devices at the inner 
levels, or more end systems. Adding a higher-port device type to a level is usually 
the cheapest fix, because the generator picks the best fan-out available at each 
level.

Dealing with scalability

Generating ten thousand agents is one problem; visualizing them afterwards is 
the one that makes large test networks unusable.

Submaps collapse a set of agents -- or an agent and its whole subtree -- to a single
icon. Past roughly a hundred agents they stop being a convenience and start 
being the reason the canvas is still readable. The Submap Manager handles 
nesting, dissolving and editing.
 

 

Search finds any device in a ten-thousand-agent topology in seconds. Duplicate-IP
protection refuses a collision as you make it, rather than reporting it to you later.

Seven layouts arrange the canvas for you: grid, hierarchical top-down or left-to-
right, circular, star -- which suits generated topologies -- and force-directed or 
spring when you want to see how the graph really connects.

Replicate Topology is still the fastest route to scale: get one branch office exactly
right, then stamp out twenty with fresh IP subnets per copy.

Past a point, drawing the canvas stops being useful, and there the Designer offers
to generate straight to a configuration file instead. The limit on what you can 
build is not the limit on what your screen can show you.

From configuration to a running network

What the Designer saves is a standard MIMIC lab configuration -- the same .cfg 
the rest of MIMIC already consumes. The topology you just designed loads and
starts exactly like any other MIMIC configuration, in the same workflow you use 
today.

Load it, start the agents, and the network is live: every device answering SNMP 
on its own IP address, with the interface tables, the system descriptions, and the 
connectivity you laid out on the canvas. Point your management application at it 
and it discovers a ten-thousand-device network that does not exist.
 

 

That is the whole point of the exercise. The topology is not the deliverable -- the 
test bed is. What you can now do to your NMS, on demand and without a lab full 
of hardware:


  - run discovery against ten thousand devices and find out how long it
    actually takes, and what it does to your database;
  - see whether the topology map your product draws matches the topology you
    designed -- you have the ground truth, which you never do with real
    equipment;
  - break links, take devices down, change interface state, and watch how the
    application reacts;



The network you could not justify building

Every test network is a compromise between the one you need and the one you 
can afford to build. Fifty devices because that is what the lab holds. One vendor 
because that is what you have. A flat topology because wiring a realistic one by 
hand was going to take a week you did not have.

Those compromises are what the MIMIC Topology Designer removes. The network 
is described rather than assembled, so its size is a number you type; it is a file, 
so it costs nothing to keep, version, hand to a colleague, or rebuild identically in 
six months; and it is simulated, so the ten-thousandth device is as cheap as the 
first.

The question stops being "what can we build?" and becomes "what should we test
against?" -- which is the question you wanted to be asking.

If you have a test network you have been putting off building, tell us what it looks like.




Thursday, July 23, 2026

Operate MIMIC Simulator in Plain English with Claude Code Skills

 
 

 
 

 

If you run MIMIC Simulator in your lab, you already know its interfaces: the MIMICview GUI, the WebUI, mimicsh, 
and the programming APIs. Now there is one more -- and it speaks your language. With the new MIMIC Skills for 
Claude Code, you state your intent in natural language (English, or any other):  for example "start agents 1-100 
with a warm-up delay", "why is throughput down since yesterday?", "zeige mir die aktivsten Agenten", "make 
agent 5 export IPFIX to my collector", ... Claude translates it into the right MIMIC API calls, runs them, and 
shows you exactly what it did.
 

1. What the Skills Are

 
Claude Code Skills are structured instruction packages that Claude reads at invocation time. The MIMIC skill
package turns Claude into a capable MIMIC operator by pairing an orchestrating skill with a bundled knowledge 
base of the MIMIC API surface and object model. The package currently contains three skills:
 
1. mimic -- the core operator skill: configuration, agent lifecycle, runtime simulation changes, troubleshooting --  
    any operation the installed MIMIC APIs expose;
 
2. mimic-diagnostics -- an add-on performance analyst: captures mimicd's built-in instrumentation over time and answers 
    "why is it slow, and what is the bottleneck?";
 
3. mimic-netflow -- an add-on flow-export operator: configures and drives NetFlow (v5/v9/v10-IPFIX) and sFlow sources on 
    your simulated agents, pointed at your collector.

The design goal is generality, not a fixed menu of workflows. Because the skill carries the API knowledge base 
rather than a list of canned recipes, it allows you to quickly become productive with MIMIC and handles any operations 
you may want to do.
 

2. Safe by Design

 
The skills are entirely optional and non-invasive. They require no changesto your MIMIC configuration, running processes, 
or workflows -- your installation behaves identically whether or not the skills are installed.

Key guarantees:

* Claude operates MIMIC only through its APIs -- it never edits files
   under the install area, never kills processes, even if asked;
 
* MIMIC remains multi-user: a colleague can drive the GUI, WebUI, or a
   CLI on the same instance at the same time, and the skill interoperates
   with state it did not create;
 
* inverse-action undo lets you back out of a change;
 
* an opt-in audit log keeps a durable record of everything the skill did.
 

3. Learn MIMIC by Watching

 
A secondary goal shaped the whole design: transparency. Every operation is echoed as the underlying API call before 
it runs, with a brief explanation, so you see not just the result but HOW it was done. Engineers new to a corner of 
MIMIC -- say, the flow-export configuration keys -- pick it up simply by watching the skill work. The skill is also aware 
of the MIMIC documentation, both your local install's help and the cloud docs, and presents the relevant pages on request.
 

4. Diagnose Performance in a Conversation

 
The mimic-diagnostics add-on shows what this looks like for a harder task. For example, instead of manually 
collecting profiling dumps and eyeballing counters, you say "profile the daemon for the next ten minutes and tell
me where the CPU is going." The skill:
 
* captures a time series of mimicd's built-in instrumentation (no daemon
   changes needed -- capturing is effectively read-only);
* reads each dump as rates and per-thread CPU against a model of mimicd's
   internal pipeline;
* reports the bottleneck -- throughput, latency, lock contention,
   per-request cost -- and compares against a known-good baseline if you
   have one.
 

5. Protocol Module expertise

Likewise, protocol specific skills like mimic-netflow turns a multi-step flow-export setup -- load the protocol 
module, attach a flow-source configuration, set the collector, enable, verify emission -- into one request: 
for example "have agent 12 export NetFlow v9 to 10.0.0.5:2055 and confirm the collector is receiving." 
The skill checks that the NetFlow module is loaded on your instance, walks the configuration through the
daemon's protocol commands, and verifies the session through statistics
and trace output.
 
Other protocol module expertise will be loadable on demand via the MIMIC Update Wizard.

6. Wrapping Up


The MIMIC Skills package adds a natural-language interface alongside the interfaces you already use -- 
one that executes your intent through the same APIs, shows its work, and leaves everything else untouched. For labs
already scripting MIMIC scenarios against Zabbix, Dynatrace, ElastiFlow, or LiveNX, this is the fastest 
path yet from "what I want to test" to a running simulation.

Contact us to try the MIMIC Skills for Claude Code in your environment.


Monday, November 3, 2025

MIMIC Simulator: Exercise threat detection in ElastiFlow

As we have seen before, MIMIC allows you to simulate network telemetry/flow exporter 
(e.g., NetFlow, IPFIX, sFlow) and SNMP agent of many virtual devices. You can fully customise 
the flow records and device behavior: e.g., set source/destination IPs, protocols, ports, 
packet/byte counts, export intervals, etc. You can manipulate the instrumentation 
of agent MIBs in the simulation in real-time: change MIB object values, add/remove MIB 
table entries, simulate traps, etc.
 
 

NetObserv is a network-flow and telemetry analytics platform: it ingests flows 
(NetFlow/IPFIX/sFlow) and SNMP/telemetry, normalises/enriches them, then provides 
dashboards, alerts, and security/operational analytics.  On the security side, NetObserv 
can detect things like port scans, unusual protocol usage, data exfiltration attempts, 
link saturation, routing anomalies, DDOS, among others.



When you combine the two tools, you get a controlled lab environment in which you can 
simulate threat-scenarios via MIMIC, and then ensure that your NetObserv setup detects 
them. Here’s how you can customise threat detection:

1. Simulate specific malicious/abnormal flows

Your flow source(s) will export flows for many ports, unusual source / destination combinations, 
unexpected protocol usage, high volume flows from internal to external, etc.
 
Your SNMP agents can simulate devices or network segments going into abnormal 
states via SNMP that might reflect threat behaviour (e.g., interface up/down, weird 
routing, high error rates).
 
Because you control every field in the flow record and instrumentation, you can test 
how NetObserv will behave if certain vendor-specific fields are present, or if flows are 
mal-formatted, or spoofed sources are used.

2. Configure NetObserv rules/analytics to catch your scenarios

Once the simulated flows appear in NetObserv, you can inspect how the detection logic 
(alerts, machine-learning models, anomaly detectors) handles them.

You can then fine-tune thresholds, detection logic, filters, enrichment settings so that your 
crafted malicious/abnormal flows trigger the appropriate alerts (or don’t trigger false positives).

For example: if you simulate “data exfiltration” flows (large outbound flows at odd hours 
to unknown destinations), you can validate that NetObserv flags those; if not, you adjust 
the detection rule.

Because you have full control of simulation, you can test edge cases: low-volume stealth 
exfiltration, internal lateral movement, scanning disguised as normal traffic, etc.

 

The following Youtube video shows this in 3 minutes:


 

 

 

Wednesday, October 1, 2025

Customize Zabbix with MIMIC Simulator

If you have a lab to test Zabbix prior to deployment, you can use MIMIC Simulator 
not just for monitoring, but also any operational customizations you’ve made (like triggers, 
escalations, actions, scripts, dashboards, etc.) without touching the production network. 

 



 Here’s how you can set it up and test systematically:

1. Define What You’re Testing

Operational customizations in Zabbix usually include:
  • Triggers: thresholds, dependencies, recovery expressions
  • Actions: notifications, escalations, scripts, integrations
  • User roles: who gets what alerts, permissions
  • Dashboards / Widgets: visualizations of problem states
  • Custom items / discovery rules: SNMP, IPMI, JMX, or scripts
MIMIC gives you the data feed (SNMP, NetFlow, Syslog, MQTT, etc.) to exercise those.

2. Connect Zabbix to MIMIC

Configure MIMIC to simulate the network devices or servers Zabbix expects:
  • SNMP agents (routers, switches, firewalls, servers) with custom MIBs
  • Interfaces / traffic patterns for NetFlow/sFlow/IPFIX
  • Syslog events for log-based monitoring
  • Ping / ICMP / TCP services for availability checks
Point Zabbix to those MIMIC devices as if they were real.

3. Drive Scenarios in MIMIC

To test Zabbix customizations, you can script scenarios in MIMIC:
  • Threshold violation
        Example: Raise interface utilization above 80% to trigger a Zabbix alert.
  • Flapping conditions
        Oscillate values around the threshold to test hysteresis and trigger dependencies.
  • Multiple-failure cascades
        Simulate a router outage that makes downstream devices unreachable, then
        see if your trigger dependencies suppress noise.
  • Custom MIB objects

        Simulatr enterprise MIBs and vary them to trigger your Zabbix custom items.

  • Logs/events

        Send specific syslog entries (e.g., authentication failure, hardware error) to test actions.

  • High-volume scenarios
        Generate events from hundreds of devices to test scalability and load on Zabbix plus 
        your custom dashboards.

4. Verify Zabbix Customizations

As you run scenarios:

  • Check whether triggers fire correctly (no false positives/negatives).
  • Validate actions: did the right people get notified? Did escalation scripts run?
  • Watch dashboards update in real time.
  • Confirm permissions/roles: does each user see only what they should?
  • Measure response time: does Zabbix handle bursts of simulated alerts as expected?

5. Automate Regression Testing

Because MIMIC is scriptable (via APIs and scenarios), you can build a test suite to run on-demand:

  • Run a set of MIMIC-driven failures.
  • Capture Zabbix responses (via API, audit logs, or UI checks).
  • Compare against expected results.

This gives you a repeatable regression test bed for Zabbix customizations before 
deploying changes.

Wednesday, September 10, 2025

How a Simulator Like MIMIC Simulator Helps nGenius Customers

Netscout nGenius is a service assurance and performance management platform
It ingests NetFlow/IPFIX  and packets, metadata, and application-level information
Customers use it to monitor end-to-end service delivery, VoIP/UC quality, and application 
performance.

Common problems that customers can run into are:

  1. High Data Rates – Full packet capture plus flows can overwhelm storage and analysis systems.

  2. Service/Application Visibility Gaps – Correlating flows, packets, and user experience is complex.

  3. Scalability and Cost – Packet-based monitoring requires very powerful hardware and lots of storage.

  4. Multi-Vendor Complexity – Different devices export different flows/metadata.

  5. Training & Troubleshooting – Staff need to learn how to interpret flow + packet data for root cause analysis.

  6. Integration Challenges – Feeding nGenius data into ITSM/SIEM/SOC tools isn’t always straightforward.

     

 

 

 

MIMIC Simulator Suite virtualizes large network environments to help tackle some of these problems:

  1. Validate Scale – Generate realistic traffic (flows + emulated devices) to see how nGenius handles high loads before production.

  2. Application/Service Testing – Simulate voice, video, or application flows so teams can practice monitoring service quality.

  3. Multi-Vendor Assurance – Emulate Cisco, Juniper, Palo Alto, etc. devices to test interoperability.

  4. Training Lab – Give engineers real scenarios (DDoS, poor QoS, packet loss) without touching live users.

  5. Safer Testing – Use simulated instrumentation data (SNMP, NetFlow, sFlow) instead of actual sensitive user data, avoiding compliance risks.

  6. Integration Validation – Feed nGenius with reproducible test data to confirm workflows with SIEM, NMS, or service desks.

 

 


 

Tuesday, August 5, 2025

MIMIC Simulator and LiveNX

LiveNX customers can benefit from MIMIC Simulator to complement their in-house lab at a fraction of the cost of real equipment: 

 

Customize LiveNX

  • Enables rapid development of custom features by recreating the exact scenario in MIMIC with repeatable test data.

  • This makes development, troubleshooting and support faster and more precise.

     

Large-Scale Test Environments

  • LiveNX is designed to monitor enterprise and service provider networks with thousands of devices and interfaces.

  • With MIMIC, LiveNX customers can simulate tens of thousands of routers, switches, firewalls, and endpoints before deploying in production.

  • This allows validation of LiveNX scalability without needing physical gear. Resources can be allocated well in advance to ensure smooth operations.


Figure 1 - Topology view with connections between sites


Training and Demos Without Real Hardware

  • MIMIC can generate realistic SNMP responses from a variety of vendor devices and pathological scenarios, as well as NetFlow, sFlow, and syslog traffic.

  • LiveNX teams can train staff and demonstrate LiveNX features using fully controlled, reproducible simulated environments — no need to access the live production network.

  • Disaster preparation can be done safely in the simulated lab.

 

Figure 2 - Traffic breakdown for one of the connections

 

Network Change / Upgrade Validation

  • Before rolling out firmware upgrades, new device models, or topology changes, LiveNX users can simulate the new environment in MIMIC.

  • This ensures LiveNX’s discovery, topology visualization, and performance analytics work correctly ahead of time.


Proof-of-Concept (PoC) Acceleration

  • Customers evaluating LiveNX can set up large testbeds overnight with MIMIC instead of waiting for lab hardware.

  • This reduces time-to-value and makes the PoC process smoother.









Monday, June 2, 2025

MIMIC Simulator and Dynatrace

In our quest to support all possible network management platforms, we have

interoperated with Dynatrace by discovering large networks:



 

 

 

 

 

 

 

 

 

 

and drilling into devices: