What Is an ASN? Understanding Autonomous System Numbers

An Autonomous System (AS) is a large network or group of networks that operates under a single administrative policy. Think of it as one of the building blocks of the internet. Each ISP, large company, university, and content provider that connects directly to the internet backbone typically operates its own Autonomous System.

For example, Google operates AS15169, Comcast operates AS7922, and Amazon operates AS16509. When you send data across the internet, it often passes through multiple Autonomous Systems on its way to the destination.

Each Autonomous System is assigned a unique number called an ASN (Autonomous System Number), which is used by the BGP (Border Gateway Protocol) routing protocol to direct traffic between networks.

The internet is not a single network — it's a network of networks. ASNs are the identifiers that allow these networks to communicate and route traffic between each other using BGP.

Here's a simplified view of how it works:

1. Each Autonomous System announces the IP address ranges (prefixes) it owns to its neighboring ASes via BGP.
2. These announcements propagate across the internet, so every AS knows which IP prefixes are reachable through which paths.
3. When traffic needs to travel from one AS to another, BGP determines the best path based on policies, shortest AS path, and other factors.
4. The traffic hops between Autonomous Systems until it reaches the AS that owns the destination IP address.

ASNs come in two sizes: 2-byte ASNs (0–65535), which are the original format, and 4-byte ASNs (0–4294967295), introduced when 2-byte ASNs started running out. Both are in active use today.

When you look up any IP address on LookMyIP (lookmyip.com), the results include the ASN associated with that IP. This tells you which organization operates the network that IP belongs to.

What ASN information reveals:

• Organization name: The company or institution that operates the network.
• Network size: How many IP addresses the AS announces (its IP space).
• Network type: Whether it's an ISP, hosting provider, content delivery network, enterprise, or educational institution.
• Geographic presence: Where the network operates.
• Peering relationships: Which other networks it connects to directly.

ASN information is useful for understanding who controls a particular IP address. For example, if an IP's ASN belongs to a cloud hosting provider like AWS or DigitalOcean, you know that IP is likely a server, not a regular user. If the ASN belongs to a residential ISP, it's more likely a home or business user.

Network troubleshooting: When diagnosing connectivity issues, knowing which ASes traffic passes through helps identify where the problem lies. Tools like traceroute combined with ASN lookups reveal the network path.

Security and threat intelligence: ASN information helps identify the source of attacks, spam, or suspicious traffic. Certain ASNs are known for hosting malicious activity, and security teams may block entire ASes when necessary.

IP reputation and email deliverability: Email reputation services consider the ASN when evaluating sender trustworthiness. IP addresses from certain hosting ASNs may face stricter scrutiny.

Network peering decisions: Network operators use ASN data to make peering and transit decisions — choosing which networks to connect with directly for better performance and cost efficiency.

Content delivery: CDNs use ASN information to optimize routing and cache placement, ensuring content is delivered from the closest server to each user's network.

The AS path is the most information-dense field in a BGP route, and learning to read it turns an opaque routing table into a readable map of how traffic reaches a destination.

A path looks like this:

AS_PATH: 64500 3356 15169

Read it right to left. 15169 is Google, the network that originated the announcement and owns the address block. 3356 is Lumen (formerly Level 3), a tier-one transit provider. 64500 is the network that received the announcement — the reader's own upstream. So the route reaches Google via Lumen, two hops away in AS terms.

Note that AS hops are not router hops. A single AS may contain hundreds of routers and span continents. A three-AS path can cross an ocean; a six-AS path can stay within one city.

Two patterns are worth recognising:

Prepending. A path like 64500 64500 64500 3356 15169 shows the origin deliberately repeating its own ASN. Because BGP prefers shorter paths, prepending makes a route look worse and pushes traffic to an alternative link. It is the standard crude tool for outbound traffic engineering — usually seen on a backup link that should carry traffic only when the primary fails.

Path length is not latency. BGP has no concept of speed, distance or congestion. It picks the shortest AS path, which may be a saturated link while a four-hop alternative runs over uncongested fibre. This is why the fastest route and the chosen route routinely differ, and a large part of why CDNs exist.

You can inspect real paths without running a router by using a looking glass — RIPE RIS, Hurricane Electric's BGP toolkit, or any transit provider's public looking glass will show the paths currently visible for a prefix.

Networks connect to each other in two economically distinct ways, and the difference explains most surprising routing behaviour.

Transit is a customer relationship. You pay a larger network to carry your traffic to everywhere on the internet. Money flows from the smaller network to the larger one.

Peering is a settlement-free exchange. Two networks agree to carry traffic destined for each other's customers at no charge, usually because the volume is roughly balanced and both save on transit costs. Peering happens either privately, over a direct cross-connect, or publicly at an internet exchange point such as DE-CIX Frankfurt, AMS-IX Amsterdam or LINX London.

This produces the informal tier structure:

• Tier 1 — networks that reach the entire internet purely through peering, buying transit from nobody. There are roughly a dozen, including Lumen, Arelion, GTT, NTT, Telia and Cogent.
• Tier 2 — large regional networks that peer extensively but still buy some transit. Most national ISPs sit here.
• Tier 3 — networks that purchase transit for essentially all their connectivity. Most local ISPs and small hosting companies.

The consequences show up in ways users notice.

Peering disputes cause real outages. When two large networks disagree over the terms of an interconnection, traffic between their customers can degrade badly while both refuse to upgrade a congested link. The long-running Cogent–Hurricane Electric IPv6 dispute has meant portions of the IPv6 internet have been mutually unreachable for years.

Traffic takes geographically absurd routes. Two ISPs in the same city may exchange traffic via Frankfurt or London because that is where they both have a presence at an exchange and neither has a local interconnect. This "tromboning" adds tens of milliseconds and is a business artefact rather than a technical one.

You can see which ASN sits behind any address, and therefore who to ask about a routing problem, with the IP lookup tool or a WHOIS query against the address.

BGP was designed in an era when every operator was known and trusted. It has no built-in authentication: a router announcing "I have the route to this prefix" is believed by default. That flaw has produced a long history of incidents.

Pakistan Telecom / YouTube, 2008. Ordered to block YouTube domestically, the operator announced a more specific route for YouTube's prefix. The announcement leaked to its upstream and propagated globally, taking YouTube offline worldwide for roughly two hours.

Amazon Route 53 / MyEtherWallet, 2018. Attackers hijacked Amazon DNS prefixes, redirected MyEtherWallet users to a server they controlled, and stole roughly $150,000 in cryptocurrency.

Rostelecom, 2020. Over 8,800 prefixes belonging to more than 200 networks, including Google, Amazon and Cloudflare, were briefly announced by a Russian ISP.

Two mitigations are now deploying at scale.

RPKI (Resource Public Key Infrastructure) lets an address holder publish a signed Route Origin Authorization stating which ASN may originate a given prefix. Networks that validate RPKI drop conflicting announcements. Adoption passed half of announced prefixes in 2024, and all major cloud providers and most tier-one transit networks now drop invalid routes.

MANRS (Mutually Agreed Norms for Routing Security) is a set of operational commitments — filter your customers' announcements, validate source addresses, keep registry data accurate — that participating networks agree to implement.

If you operate address space, publishing ROAs is the single highest-value routing security step available, and it is free through your RIR's portal.

How do I get my own ASN?

Apply to your regional registry — ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC. You need to demonstrate multihoming, meaning connections to at least two other networks, and a genuine routing policy. Fees are modest, typically a few hundred dollars annually. In practice you also need address space to announce and at least one transit provider or peering relationship, so it is a step for organisations running their own network rather than for individuals.

What is the difference between a 16-bit and a 32-bit ASN?

The original field was 16 bits, allowing 65,536 values, and that pool effectively exhausted in 2011. RFC 6793 extended it to 32 bits, giving roughly 4.3 billion. Modern allocations are 32-bit and appear as larger numbers, sometimes written in the older dotted format. Both work; the transition is complete.

Why do two lookups report different ASNs for the same IP?

Usually because the address is announced by one ASN but registered to another — common with hosting resellers and with organisations using a transit provider's address space. It can also reflect a recent transfer that one database has not picked up, or a more specific prefix announced by a different network than the covering block.

Can I see the full routing table?

Yes. RIPE RIS and the University of Oregon's RouteViews project both publish complete BGP feeds and historical archives. The global IPv4 table now exceeds 950,000 prefixes, which is why router memory requirements keep climbing and why older hardware with fixed table sizes has had to be retired.

Does an ASN tell me who owns an IP address?

It tells you which network announces it, which is often but not always the same thing. A cloud provider's ASN covers every customer on that platform, so knowing an address belongs to AS16509 tells you it is AWS, not which AWS customer. For that you need more specific registration data, and often it simply is not public.