Look up any IP address on our IP lookup and one of the fields is an ASN, something like AS15169 or AS13335. Most people skip past it to the city and ISP. But that number is how the internet itself knows who an address belongs to, and it's often more useful than anything else on the page.
There's no central map of the internet. What exists instead is tens of thousands of separately run networks: ISPs, cloud providers, universities, content companies, large businesses. Each one controls its own chunk of IP addresses and its own routers.
Each of those networks is an autonomous system. ARIN, the regional registry for North America, defines an AS as "a group of one or more IP prefixes run by one or more network operators that maintain a single, clearly-defined routing policy." In plain terms, it's a network that makes its own decisions about how traffic gets in and out.
An ASN, or Autonomous System Number, is the unique number that identifies one of these networks. Google's main network is AS15169. Cloudflare's is AS13335. When you see those numbers, you're looking at a network's identity, not a single machine.
Networks tell each other which addresses they can reach using BGP, the Border Gateway Protocol. A network announces something like "I am AS64500 and I originate 203.0.113.0/24." Its neighbours pass that on, each adding its own ASN to the front of the path. By the time the announcement reaches a network on the other side of the world, it carries a list of every AS it went through.
So when your ISP's routers decide where to send a packet for 203.0.113.10, they look at all the routes they've heard for that prefix and pick one. The AS path is a big input. All else being equal, a shorter path wins. But "all else" is rarely equal. Networks prefer routes through partners they peer with for free over routes they pay a transit provider for, and those business relationships often matter more than distance.
That's why traffic sometimes takes a route that looks absurd on a map. Your packets aren't following the shortest cable. They're following the cheapest or most preferred chain of networks. When a traceroute shows a detour through another country, the reason is usually in the AS path.
ASNs were originally 16-bit numbers, which allows a maximum of 65,535. That turned out to be nowhere near enough. RFC 6793 extended BGP to carry 32-bit AS numbers, so the space now runs to 4,294,967,295.
You'll still run into one leftover from the transition. Older routers that only understand two-byte numbers see four-byte ASNs replaced with a placeholder, AS23456, called AS_TRANS. If an old tool or log shows AS23456 in a path, it's that placeholder, not a real network.
A few ranges are set aside by IANA and never belong to a public network:
If you ever see a private ASN in a public route, something has leaked that shouldn't have.
IANA allocates blocks of ASNs to the five regional internet registries: AFRINIC, APNIC, ARIN, LACNIC and RIPE NCC. Networks apply to the registry for their region, the same way they apply for IP address space.
Most people and most businesses never need one. Your home connection and your small office sit inside your ISP's AS. A company generally needs its own ASN when it wants to connect to more than one upstream provider and control how its addresses are announced, which is called multihoming. That's how a network stays reachable if one provider fails.
The quickest way is to paste the address into our IP lookup, which shows the ASN and the organisation that holds it.
From a terminal, Team Cymru runs a free whois service that maps IPs to ASNs:
whois -h whois.cymru.com " -v 198.51.100.7"Swap in the address you care about. The answer gives the ASN, the announced prefix, the country and the registry. The quotes and leading space are deliberate: they send -v to the server as part of the query instead of to your local whois client.
To go the other way and see which prefixes an AS says it originates, query a routing registry such as RADb:
whois -h whois.radb.net -- '-i origin AS13335'That returns route objects the network has registered. It's what the operator has declared, not a live view of the routing table, so treat it as a strong hint rather than the final word. For live data, public looking-glass sites and route viewers such as bgp.he.net show what's actually being announced.
Some traceroute tools can label each hop with its ASN. On macOS, traceroute -a turns this on, and on Linux the common traceroute package uses -A. It makes it obvious where your traffic leaves your ISP and enters someone else's network. Our guide to reading a traceroute covers the rest of that output.
The ASN answers "whose network is this?", which is often the question that actually matters.
Hosting versus residential. If the ASN belongs to a cloud or hosting provider, the traffic came from a server, not somebody's home. That's a strong signal when you're looking at a login attempt or a suspicious signup.
Who to contact about abuse. The registry record for the ASN names the organisation responsible. An abuse report sent to the network operator gets further than one sent to nobody.
Why geolocation is off. Location databases lean heavily on who holds the address block. A big network that routes traffic from many countries through one AS can confuse them. We cover this in how accurate is IP geolocation.
Blocking or allowing by network. Firewalls and CDNs can match rules on ASN, which saves you from maintaining a list of a provider's prefixes by hand.
No. An IP address identifies one interface on one device. An ASN identifies a whole network that may announce thousands or millions of addresses. One ASN, many IPs.
Yes. Large providers often run separate ASNs for different regions, acquired businesses or distinct services. Seeing two different ASNs for addresses owned by the same company is normal.
Not its own. Your connection uses your ISP's ASN, which is why an IP lookup on your address shows your ISP's name and number. Our what is my IP address guide explains the rest of what that lookup shows.
It's when a network announces address space it doesn't own, deliberately or by mistake, and other networks believe it. Traffic for those addresses then flows to the wrong place. RPKI lets address holders publish which ASN is allowed to originate their prefixes, so networks that check it can reject bogus announcements.
0 comments
No comments yet. Be the first.