MIMIC runs on
It is highly recommended to install the latest service pack for the respective OS. The following are some of the most common problems encountered on Windows, and their fixes:
For Windows Vista, Server 2008 and Windows 7 and newer, please go to the section below.
Due to pervasive security attacks against Windows systems connected to the Internet, it has become common to run a software firewall on recent versions of Windows.
MIMIC will coexist with a software firewall, provided that the firewall is configured to recognize MIMIC as a program allowed to access the network. MIMIC will, due to its very nature of simulating networked components, open network sockets and communicate with external applications (eg. network management applications, telnet clients, etc).
There are certain components of MIMIC that will access the Internet (eg. specific web sites to determine software updates, etc), but only if explicitly configured by the user.
MIMIC requires at least one operational network interface card (NIC). On Windows Vista or later, as on the Unix platforms, MIMIC dynamically assigns IP addresses when starting each agent instance.
Different versions of Windows have performance limitations while running large numbers of IP addresses. The following are the limits on the different versions of Windows:
In empirical tests, going beyond those limits introduced non-deterministic instability and performance problems.
You can run 20000 agents only on Windows Server 2003, and 30000 agents only on Windows Server 2012, 2019, Windows 8, 10, 11, and then only with 64-bit executables, and more on the Unix platforms.
MIMIC is a specially memory-intensive application, and it needs plenty of physical memory (RAM) and virtual memory (swap space) for the more complex device simulations. We recommend an absolute minimum 1 GB of RAM and 2 GB of swap space to start. Verify that you have enough swap space in the System Control Panel.
You should as a rule of thumb have twice the swap space as your physical memory.
Different versions of Windows on Intel systems impose different limits on the amount of virtual memory accessible for the MIMIC Simulator, but currently the absolute limit is below 4 GB due to 32-bit addressing limitations, which the 64-bit architecture does not have.
On all 32-bit versions of Windows there is a 2 GB limit on per-process virtual memory. The following steps only apply to legacy 32-bit systems.
On Windows Vista and later Microsoft has removed the boot.ini file and provided the BCDEdit command to enable 3 GB addressing as documented in this document.
To enable this expanded capability on Windows Vista and later, as an Administrator in a Command Prompt window, type the command:
BCDEdit /set IncreaseUserVA 3072
And then restart your computer.
This will make "a full 3 GB of virtual address space available to applications and reduces the amount available to the system to 1 GB."
For Windows Vista, Server 2008 and Windows 7 and later, please go to the section below.
If Windows detects that an IP address on one of its Network Interface Cards (NICs) conflicts with another system (duplicate IP address), then it tries to resolve this problem by shutting down the NIC and displays a message such as:
The System has detected an IP address conflict with another system on the network. The local interface has been disabled. More details are available in the system event log. Consult your network administrator to resolve the conflict.
You must not have duplicate IP addresses on a connected network, neither with MIMIC or otherwise.
NOTE: you can disable duplicate IP address detection by following the instructions in the article in the ( now defunct) Microsoft Knowledge Base titled How to Disable the Gratuitous ARP Function. It is appended here:
How to Disable the Gratuitous ARP Function View products that this article applies to. Article ID : 219374 Last Review : February 24, 2007 Revision : 3.2 This article was previously published under Q219374 SYMPTOMS When a Windows NT-based computer starts, a packet is broadcast on the network containing the computer's TCP/IP address to prevent the use of duplicate addresses on the same network. This is called a gratuitous Address Resolution Protocol (ARP) packet. Routers and other network hardware may cache routing information gained from multiple gratuitous ARP packets. For both performance and maintenance reasons, it is possible to disable this feature in Windows NT. RESOLUTION To resolve this problem, obtain the latest service pack for Windows NT 4.0. For additional information, click the following article number to view the article in the Microsoft Knowledge Base: 152734 (http://support.microsoft.com/kb/152734/EN-US/) How to Obtain the Latest Windows NT 4.0 Service Pack STATUS Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Windows NT 4.0 Service Pack 5. MORE INFORMATION To disable gratuitous ARPs after applying this hotfix: 1. Click Start, click Run, type regedt32, and then click OK. 2. On the Windows menu, click HKEY_LOCAL_ MACHINE on Local Machine. 3. Click the \System\CurrentControlSet\Services\TcpIp\Parameters folder. 4. Double-click the ArpRetryCount value, type 0, (for Windows XP, type 1) and then click OK. 5. Quit Registry Editor, and then restart the computer.
Newer versions of Windows (Windows Vista onwards) have a TCP/IP feature whereby it can sense if a NIC is actually connected to the network. By default, a NIC is disabled if it is not found to be on the network, which prevents agents from starting in MIMIC. There is a way to disable this behaviour so that you can work on standalone Windows machines. Attached is an excerpt of the Microsoft KB article on this topic... Please remember to make a copy of your registry before making any changes just to be on the safe side.
NOTE Windows Vista and newer have no way to disable this feature. You can only run MIMIC on Windows Vista and newer with the system connected to a network.
How to disable the Media Sensing feature for TCP/IP in Windows SUMMARY On a Windows-based computer that uses TCP/IP, you can use the Media Sensing feature to detect whether the network media are in a link state. Ethernet network adapters and hubs typically have a "link" light that indicates the connection status. This status is the same condition that Windows interprets as a link state. Whenever Windows detects a "down" state, it removes the bound protocols from that adapter until it is detected as "up" again. Sometimes, you may not want the network adapter to detect this state. You can set this configuration by modifying the registry. Let me fix it myself Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base: 322756 How to back up and restore the registry in Windows To prevent the network adapter from detecting a link state, follow these steps. Note The NetBEUI protocol and the IPX protocol do not support Media Sensing. Start Registry Editor. Locate the following registry subkey: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters Add the following registry entry to the Parameters subkey: Name: DisableDHCPMediaSense Data type: REG_DWORD (Boolean) Value: 1 Note This entry controls the behavior of Media Sensing. By default, Media Sensing events trigger a DHCP client to take an action. For example, when a connect event occurs, the client tries to obtain a lease. When a disconnect event occurs, the client may invalidate the interface and routes. If you set this value data to 1, DHCP clients and non-DHCP clients ignore Media Sensing events. Restart the computer.
IPv6 is supported only on Windows Vista and newer. This is an OS platform limitation.
IPv6 is installed as detailed here. IPv6 addresses use an additional Scope ID as detailed on the Microsoft web-site.
If the IPv6 module gets corrupted, you can fix this with this command from the COMMAND prompt:
netsh interface ipv6 reset
NOTE: check the Known Problems section for limitations.
Running unnecessary Windows services impacts performance adversely on a MIMIC system. The observed impact has been an approximate 300% slowdown in starting and 1000+% slowdown stopping agents, and a 10-20% slowdown in servicing requests. This is documented in a Microsoft support page titled "Memory usage by the Lsass.exe process on domain controllers that are running Windows Server 2003 or ...". The executables running the services end up hogging the CPU. This can easily be seen in a process listing in the Windows Task Manager.
Thus if you are running large lab configurations, we recommend to stop the following unnecessary services in the Services Control Panel:
Display Name Service Name Path to executable ------------------------------------------------------------------- IPSEC Services PolicyAgent WINDOWS\system32\lsass.exe Protected Storage ProtectedStorage WINDOWS\system32\lsass.exe Print Spooler Spooler WINDOWS\system32\spoolsv.exe DHCP Client Dhcp WINDOWS\system32\svchost.exe -k NetworkService DNS Client Dnscache WINDOWS\system32\svchost.exe -k NetworkService TCP/IP NetBIOS Helper LmHost WINDOWS\system32\svchost.exe -k LocalService Windows Time W32Time WINDOWS\system32\svchost.exe -k netsvcs
Additionally, on Windows Server 2003 we have seen the RPC service hog the CPU while MIMIC is busy servicing SNMP requests. On Windows XP SP2 we have seen the RPC service crash when stress testing MIMIC, thus rebooting the system by default. We recommend stopping all svchost.exe processes, and make sure that the services are configured not to restart or reboot the system.
The optional 64-bit MIMIC simulator and protocol module shared libraries can run on a x64 or AMD64 processor. To do so, you need to run a 64-bit version of Windows , and use Update Wizard to download the optional update package with the MIMIC 64-bit executables.
Windows Vista and later has the new User Account Control feature, which impacts the running of MIMIC. For details, consult this Analysis of the Windows Vista Security Model from Symantec. In order to enable to run MIMIC on Vista and later, you have 2 options:
This turns UAC off globally. NOTE: do this only if you are aware of the implications of this action.
This involves changing the access control level of the MIMIC programs.
On Windows Vista and later, the new TCP/IP stack tries to do "duplicate address detection" by default. This prevents MIMIC from starting agents, because IP aliasing is delayed, and even with a workaround in our software would unacceptably slow down the starting of agents. To correctly workaround the problem, you need to disable "duplicate address detection" for the network interface using the Windows netsh utility:
netsh interface ipv4 set interface "name or index" dadtransmits=0
The interface name and index info can be obtained by
netsh interface ipv4 show interfaces
H:\>netsh interface ipv4 show interfaces Idx Met MTU State Name --- --- ----- ----------- ------------------- 1 50 4294967295 connected Loopback Pseudo-Interface 1 7 20 1500 connected Local Area Connection H:\>netsh interface ipv4 set interface "7" dadtransmits=0
The same applies to IPv6.
netsh interface ipv6 set interface "name or index" dadtransmits=0
Windows Vista and later has the problem of services interfering with MIMIC operation as documented above.
Here is the list of already documented services and their paths:
Display Name Service Name Path to executable --------------------------------------------------------------------------------------------- IPsec Policy Agent PolicyAgent WINDOWS\system32\svchost.exe -k NetworkServiceNetworkRestricted Protected Storage ProtectedStorage WINDOWS\system32\lsass.exe Print Spooler Spooler WINDOWS\system32\spoolsv.exe DHCP Client Dhcp WINDOWS\system32\svchost.exe -k NetworkServiceNetworkRestricted DNS Client Dnscache WINDOWS\system32\svchost.exe -k NetworkService TCP/IP NetBios Helper lmhosts WINDOWS\system32\svchost.exe -k NetworkServiceNetworkRestricted Windows Time W32Time WINDOWS\system32\svchost.exe -k LocalService
Additionally, these new services in Windows Vista and later MUST be disabled for reasonable start/stop performance.
Display Name Service Name Path to executable --------------------------------------------------------------------------------------------- Function Discovery Resource Publication FDResPub WINDOWS\system32\svchost.exe -k LocalService IKE and AuthIP Keying Modules IKEEXT WINDOWS\system32\svchost.exe -k netsvcs Network List Service netprofm WINDOWS\system32\svchost.exe -k LocalService Network Location Awareness NlaSvc WINDOWS\system32\svchost.exe -k NetworkService SSDP Discovery SSDPSRV WINDOWS\system32\svchost.exe -k LocalService UPnP Device Host upnphost WINDOWS\system32\svchost.exe -k LocalService Windows Remote Management (WS-Management) WinRM WINDOWS\system32\svchost.exe -k NetworkService
These are new services that may be disabled for better start/stop performance on Windows Vista and later.
Display Name Service Name Path to executable --------------------------------------------------------------------------------------------- Background Intelligent Transfer Service BITS WINDOWS\system32\svchost.exe -k netsvcs IP Helper iphlpsvc WINDOWS\system32\svchost.exe -k netsvcs
Used for publishing network resources. Stopping will prevent other computers from discovering the network resources. Will impact applications that work with Network Connected Devices, Plug-n-Play Extensions and Web Services on Devices.
Internet Key Exchange (IKE) and Authenticated Internet Protocol (AuthIP) keying modules are used for authentication and key exchange in IPSec. Stopping them will prevent IPSec from working.
Used to determine the networks to which the system is connected, collect/store their properties and notify applications.
Stopping this will prevent the Network Status tray icon from working properly.
Used to collect/store network configuration information and notify applications.
Stopping this will prevent any applications (like Network List Service) that depend on this data from working.
Used to provide Simple Service Discovery Protocol based services. Stopping this will prevent UPnP from working.
Used to provide Universal Plug-n-Play services. Stopping this will prevent UPnP based devices from working.
Used for Web Services for Management funcationality. Stopping will disable Windows Remote Management and WS Management
The default power options will put the Windows Vista system to sleep after 1 hour of inactivity. To disable this, perform the following:
Open Power Options using Control Panel->System and Maintenance->Power Options.
Change Preferred Plan from Balanced to High Performance.
Verify by clicking on Change Plan Settings for High Performance. Ensure that Put the computer to sleep setting is Never.
After the install is completed or aborted, the Program Compatibility Assistant may prompt with the message
This program might not have installed correctly.Please select This program installed correctly if the install completed. Else, select Cancel.
Prior to Windows Vista, crashes can be analysed post-mortem using the Dr. Watson Tool crash dumps. This requires that Dr. Watson be enabled to handle any application exceptions on the system.
To install Dr. Watson as the default exception handler :
A subsequent crash should popup the Dr. Watson dialog. Search for the following files in the Windows directory (this location can be changed using the Dr. Watson GUI) : drwtsn32.log and user.dmp . Send these to Gambit Technical Support (firstname.lastname@example.org).
On Windows Vista and later, by default the Problem Reports and Solutions feature handles program crashes. Crash information, including minidumps when available, is automatically sent to Microsoft.
You can check if a MIMIC program crashed and if minidumps are available. Please use the following steps to extract any available MIMIC program crash data and forward it to Gambit Technical Support ( email@example.com).
If the Problem Reports and Solutions settings are changed to check with the user before sending the crash information to Microsoft, Windows Vista will prompt the user when a program crash occurs. If you choose Close the program, no additional details are generated. If you choose Check online for a solution and close the program, crash data may be saved.
Microsoft's Debug Diagnostic Tool version 1.1 onwards may be used on Windows Vista and later to handle program crashes. If this is installed, please use the following steps to generate crash data.
When a crash occurs, the Rules tab in Debug Diagnostic Tool will show the userdump count. Forward the available files from the configured dump location to Gambit Technical Support.
We are constantly working to remove limitations, but currently we know of the following:
The Unix versions of MIMIC have no such limitations on the number of clients.
This problem is unrelated to MIMIC. Any test program (eg. ifdiag shipped with MIMIC) which uses the Windows API to register/unregister network addresses will reproduce the problem.
When adding or deleting IPv6 aliases to/from an agent it can take 2 to 3 seconds for the operation to complete per agent. This slowness is caused by the Domain Name System (DNS) performing a lookup to see if the address is actually a registered domain name. To resolve this problem you must follow both the steps listed below:
Even with this workaround, adding and deleting IPv6 aliases is approximately 5 to 10 times slower than on Linux or Solaris. If you are running thousands of agents, your performance will suffer. On Windows 7 or later the performance is comparable to Linux provided you have disabled duplicate address detection.
Furthermore, our testing uncovered that the Microsoft netsh utility used to add aliases sometimes fails silently. For Windows 7 and later there is no such issue.
To work around this limitation, you have to increase the number of USER objects as described in this Microsoft support page . The absolute limit is 18000, which you will NOT be able to overcome. With this limit, you'll be able to display about 2000 average-sized devices. You can track "User objects" and "GDI objects" in the Task Manager "Details" tab, after enabling those columns.
In addition, there is a limit on the "desktop heap", as detailed in this Microsoft support page . Change this parameter in the registry to overcome heap limitations.
MIMIC on other platforms has no such limitation.
This applies to Windows 7 or later due to changes in Windows where Windows will automatically use the lowest IP assigned to an interface as the source IP address as explained in this Microsoft Forum and this Microsoft article.
These are the possible workarounds for MIMIC to work in this scenario:
MIMIC system IP is 10.0.0.10 then use addresses like 10.0.0.11, 10.0.0.12 etc. for MIMIC agents.
Variable: MIMIC_DEFAULT_NETDEV Value: Intel(R) 82566DM Gigabit Network
on newer high-resolution display monitors (eg. 3240x2160) you need to control the scaling of the MIMIC user interface. You can set the property on the wish86t.exe application as shown in this diagram.
Figure 1: wish86t Properties
In Windows Explorer, right-click on the wish86t.exe file in the MIMIC install area bin folder, then select Properties.
The wish86t.exe Properties dialog pops up.
Click the Compatibility tab, then click Change high DPI settings.
In the dialog that pops up, select Override high DPI scaling behavior. Scaling performed by and select System Controlled (Enhanced).
Click OK to both dialogs, and when you invoked MIMICview, it should display correctly.
Obviously, Windows is a trademark of Microsoft. All other product and brand names are trademarks or registered trademarks of their respective holders.