MIMIC Simulator: Exercise threat detection in ElastiFlow

As we have seen before, MIMIC allows you to simulate network telemetry/flow exporter 

(e.g., NetFlow, IPFIX, sFlow) and SNMP agent of many virtual devices. You can fully customise 

the flow records and device behavior: e.g., set source/destination IPs, protocols, ports, 

packet/byte counts, export intervals, etc. You can manipulate the instrumentation 

of agent MIBs in the simulation in real-time: change MIB object values, add/remove MIB 

table entries, simulate traps, etc.

 

 

NetObserv is a network-flow and telemetry analytics platform: it ingests flows 

(NetFlow/IPFIX/sFlow) and SNMP/telemetry, normalises/enriches them, then provides 

dashboards, alerts, and security/operational analytics.  On the security side, NetObserv 

can detect things like port scans, unusual protocol usage, data exfiltration attempts, 

link saturation, routing anomalies, DDOS, among others.

When you combine the two tools, you get a controlled lab environment in which you can 

simulate threat-scenarios via MIMIC, and then ensure that your NetObserv setup detects 

them. Here’s how you can customise threat detection:

1. Simulate specific malicious/abnormal flows

Your flow source(s) will export flows for many ports, unusual source / destination combinations, 

unexpected protocol usage, high volume flows from internal to external, etc.

 

Your SNMP agents can simulate devices or network segments going into abnormal 

states via SNMP that might reflect threat behaviour (e.g., interface up/down, weird 

routing, high error rates).

 

Because you control every field in the flow record and instrumentation, you can test 

how NetObserv will behave if certain vendor-specific fields are present, or if flows are 

mal-formatted, or spoofed sources are used.

2. Configure NetObserv rules/analytics to catch your scenarios

Once the simulated flows appear in NetObserv, you can inspect how the detection logic 

(alerts, machine-learning models, anomaly detectors) handles them.

You can then fine-tune thresholds, detection logic, filters, enrichment settings so that your 

crafted malicious/abnormal flows trigger the appropriate alerts (or don’t trigger false positives).

For example: if you simulate “data exfiltration” flows (large outbound flows at odd hours 

to unknown destinations), you can validate that NetObserv flags those; if not, you adjust 

the detection rule.

Because you have full control of simulation, you can test edge cases: low-volume stealth 

exfiltration, internal lateral movement, scanning disguised as normal traffic, etc.

 

The following Youtube video shows this in 3 minutes:

 

 

 

Customize Zabbix with MIMIC Simulator

If you have a lab to test Zabbix prior to deployment, you can use MIMIC Simulator 

not just for monitoring, but also any operational customizations you’ve made (like triggers, 

escalations, actions, scripts, dashboards, etc.) without touching the production network. 

 

 Here’s how you can set it up and test systematically:

1. Define What You’re Testing

Operational customizations in Zabbix usually include:

• Triggers: thresholds, dependencies, recovery expressions
• Actions: notifications, escalations, scripts, integrations
• User roles: who gets what alerts, permissions
• Dashboards / Widgets: visualizations of problem states
• Custom items / discovery rules: SNMP, IPMI, JMX, or scripts

MIMIC gives you the data feed (SNMP, NetFlow, Syslog, MQTT, etc.) to exercise those.

2. Connect Zabbix to MIMIC

Configure MIMIC to simulate the network devices or servers Zabbix expects:

• SNMP agents (routers, switches, firewalls, servers) with custom MIBs
• Interfaces / traffic patterns for NetFlow/sFlow/IPFIX
• Syslog events for log-based monitoring
• Ping / ICMP / TCP services for availability checks

Point Zabbix to those MIMIC devices as if they were real.

3. Drive Scenarios in MIMIC

To test Zabbix customizations, you can script scenarios in MIMIC:

• Threshold violation

        Example: Raise interface utilization above 80% to trigger a Zabbix alert.

• Flapping conditions

        Oscillate values around the threshold to test hysteresis and trigger dependencies.

• Multiple-failure cascades

        Simulate a router outage that makes downstream devices unreachable, then

        see if your trigger dependencies suppress noise.

• Custom MIB objects

        Simulatr enterprise MIBs and vary them to trigger your Zabbix custom items.

• Logs/events

        Send specific syslog entries (e.g., authentication failure, hardware error) to test actions.

• High-volume scenarios

        Generate events from hundreds of devices to test scalability and load on Zabbix plus 

        your custom dashboards.

4. Verify Zabbix Customizations

As you run scenarios:

• Check whether triggers fire correctly (no false positives/negatives).
• Validate actions: did the right people get notified? Did escalation scripts run?
• Watch dashboards update in real time.
• Confirm permissions/roles: does each user see only what they should?
• Measure response time: does Zabbix handle bursts of simulated alerts as expected?

5. Automate Regression Testing

Because MIMIC is scriptable (via APIs and scenarios), you can build a test suite to run on-demand:

• Run a set of MIMIC-driven failures.
• Capture Zabbix responses (via API, audit logs, or UI checks).
• Compare against expected results.

This gives you a repeatable regression test bed for Zabbix customizations before 

deploying changes.

How a Simulator Like MIMIC Simulator Helps nGenius Customers

Netscout nGenius is a service assurance and performance management platform. 

It ingests NetFlow/IPFIX  and packets, metadata, and application-level information. 

Customers use it to monitor end-to-end service delivery, VoIP/UC quality, and application 

performance.

Common problems that customers can run into are:

1. High Data Rates – Full packet capture plus flows can overwhelm storage and analysis systems.

2. Service/Application Visibility Gaps – Correlating flows, packets, and user experience is complex.

3. Scalability and Cost – Packet-based monitoring requires very powerful hardware and lots of storage.

4. Multi-Vendor Complexity – Different devices export different flows/metadata.

5. Training & Troubleshooting – Staff need to learn how to interpret flow + packet data for root cause analysis.

6. Integration Challenges – Feeding nGenius data into ITSM/SIEM/SOC tools isn’t always straightforward.

    
   

 

 

 

MIMIC Simulator Suite virtualizes large network environments to help tackle some of these problems:

1. Validate Scale – Generate realistic traffic (flows + emulated devices) to see how nGenius handles high loads before production.

2. Application/Service Testing – Simulate voice, video, or application flows so teams can practice monitoring service quality.

3. Multi-Vendor Assurance – Emulate Cisco, Juniper, Palo Alto, etc. devices to test interoperability.

4. Training Lab – Give engineers real scenarios (DDoS, poor QoS, packet loss) without touching live users.

5. Safer Testing – Use simulated instrumentation data (SNMP, NetFlow, sFlow) instead of actual sensitive user data, avoiding compliance risks.

6. Integration Validation – Feed nGenius with reproducible test data to confirm workflows with SIEM, NMS, or service desks.
   

 

 

 

MIMIC Simulator and LiveNX

LiveNX customers can benefit from MIMIC Simulator to complement their in-house lab at a fraction of the cost of real equipment: 

 

Customize LiveNX

• Enables rapid development of custom features by recreating the exact scenario in MIMIC with repeatable test data.

• This makes development, troubleshooting and support faster and more precise.

   

Large-Scale Test Environments

• LiveNX is designed to monitor enterprise and service provider networks with thousands of devices and interfaces.

• With MIMIC, LiveNX customers can simulate tens of thousands of routers, switches, firewalls, and endpoints before deploying in production.

• This allows validation of LiveNX scalability without needing physical gear. Resources can be allocated well in advance to ensure smooth operations.
  

Figure 1 - Topology view with connections between sites

Training and Demos Without Real Hardware

• MIMIC can generate realistic SNMP responses from a variety of vendor devices and pathological scenarios, as well as NetFlow, sFlow, and syslog traffic.
  

• LiveNX teams can train staff and demonstrate LiveNX features using fully controlled, reproducible simulated environments — no need to access the live production network.

• Disaster preparation can be done safely in the simulated lab.

 

Figure 2 - Traffic breakdown for one of the connections

 

Network Change / Upgrade Validation

• Before rolling out firmware upgrades, new device models, or topology changes, LiveNX users can simulate the new environment in MIMIC.

• This ensures LiveNX’s discovery, topology visualization, and performance analytics work correctly ahead of time.

Proof-of-Concept (PoC) Acceleration

• Customers evaluating LiveNX can set up large testbeds overnight with MIMIC instead of waiting for lab hardware.

• This reduces time-to-value and makes the PoC process smoother.

MIMIC Simulator and Dynatrace

In our quest to support all possible network management platforms, we have

interoperated with Dynatrace by discovering large networks:

 

 

 

 

 

 

 

 

 

 

and drilling into devices: