Natlas Tutorial: Scaling Network Scanning and Nmap Automation

Managing numerous network map files quickly becomes overwhelming during large-scale penetration tests or continuous infrastructure monitoring. While individual security audits often rely on localized discovery techniques, such as those detailed in our Nmap cheat sheet, enterprise environments require distributed execution and centralized storage. Natlas provides a robust solution to this scaling problem. By functioning as a web-based atlas for network scans, it coordinates distributed scanning agents and consolidates results into a single, easily searchable interface.

What Is Natlas?

Natlas is an open-source framework designed to scale network discovery operations. Originally built out of earlier tools like nweb, the project transforms raw scanner output into a highly searchable, historical database. The platform handles target distribution intelligently using a cyclic pseudo-random number generator (PRNG). This ensures efficient and randomized target selection across massive IP ranges, which helps prevent bottlenecks and avoids overwhelming target network firewalls with sequential connection attempts.

The system relies heavily on Elasticsearch for backend data storage, allowing operators to run complex queries against massive datasets to quickly identify specific open ports, exposed services, or vulnerable software banners.

Understanding the Server and Agent Architecture

The Natlas ecosystem relies on a decoupled architecture consisting of a central management server and distributed worker nodes. This separation of duties allows security teams to scale their scanning capacity horizontally simply by deploying additional agents.

The Natlas Server

The server component acts as the central brain of the operation. It hosts the web application interface, manages the authorized scanning scope, and orchestrates task delegation. The server does not perform any port scanning itself. Instead, it queues target blocks, hands them out to authenticated agents, and ingests the returning scan data into the database. This central repository allows security teams to query historical metrics across their entire perimeter from a single dashboard.

The Natlas Agent

Agents are lightweight workers deployed across different network segments or remote cloud environments. An agent connects to the central server, requests a target block, and executes the underlying Nmap scans against the assigned scope. Once a scan finishes, the agent parses the results and pushes the structured data back to the server. Because agents operate independently, organizations can deploy them across multiple external IP addresses to avoid aggressive rate-limiting or geographic blocking.

Docker-Based Deployment Model

To ensure consistent environments and simplify dependency management, Natlas shifted to a strict Docker-only deployment model. Running the framework requires at least one server container and one agent container. The quickest way to evaluate the platform is to deploy both containers on the same host, though production environments typically isolate the server and distribute the agents across external infrastructure.

You can retrieve the primary components from the Docker Hub registry:

docker pull natlas/server
docker pull natlas/agent

Configuration involves setting environment variables for server authentication tokens, defining the target scope in the administrative panel, and passing the server URL to the worker agents. Complete deployment scripts and environment templates are maintained on the official Natlas GitHub repository.

Scaling Network Visibility

Traditional port scanning often results in scattered XML or text files that lose their contextual value over time. Natlas solves this by treating network visibility as a continuous, searchable dataset. Security operations centers utilize the platform to detect shadow IT, monitor external attack surfaces for newly exposed services, and maintain a historical record of infrastructure changes without relying on expensive commercial vulnerability management platforms.