What Is an Autonomous System?
An Autonomous System (AS) is a collection of IP address ranges under the control of a single administrative entity — typically an ISP, hosting provider, enterprise, university, government agency, or content delivery network — that presents a unified routing policy to the rest of the internet.
The word "autonomous" refers to the fact that each AS makes its own internal routing decisions. What matters externally is not how traffic moves inside the AS, but how the AS announces its reachable IP prefixes to neighbouring autonomous systems and how it accepts traffic destined for those prefixes.
Every device connected to the public internet is reachable through one or more autonomous systems. When you send a packet from your laptop to a server in another country, that packet typically traverses four to eight autonomous systems along the way — each making its own forwarding decision based on BGP routing tables.
Large organisations with significant internet presence operate their own AS. Google runs AS15169 (and several others). Cloudflare operates AS13335. Amazon Web Services operates multiple ASNs including AS16509. Your home internet connection is almost certainly served through an AS operated by your ISP — Comcast operates AS7922, BT operates AS2856, and so on.
Smaller organisations and most end users don't need their own ASN — they receive internet access through a provider's AS and their IP addresses are part of that provider's prefix announcements.
What an ASN Actually Looks Like
An ASN is a number preceded by "AS" — for example, AS15169 (Google), AS13335 (Cloudflare), or AS7922 (Comcast). Historically ASNs were 16-bit numbers (range: 1–65535), which capped the total number of possible ASNs at around 64,000. As the internet expanded, this proved insufficient. The IANA introduced 32-bit ASNs in 2007, extending the range to over 4 billion possible values.
16-bit ASN range: 1 – 65535 (legacy format)
32-bit ASN range: 65536 – 4294967295 (extended format)
Private ASN ranges (not routed on public internet):
64512 – 65534 (16-bit private range)
4200000000 – 4294967294 (32-bit private range)
Reserved:
0 (reserved)
65535 (reserved)
4294967295 (reserved)
Private ASNs are used internally within organisations for routing between internal systems — they never appear in public BGP tables and won't show up in an ASN lookup for a public IP address.
How BGP Uses ASNs to Route Internet Traffic
Border Gateway Protocol (BGP) is the routing protocol that holds the internet together. It is the mechanism through which autonomous systems advertise their IP prefixes to each other and exchange reachability information. Understanding BGP at a high level is essential for making sense of ASN data.
BGP sessions and peer relationships
Each AS establishes BGP sessions with one or more neighbouring ASes. These relationships take three forms:
Transit: A smaller AS pays a larger AS (its upstream provider or transit provider) to carry traffic to and from the rest of the internet. The transit provider announces the smaller AS's prefixes to its other peers, giving the smaller AS global reachability.
Peering: Two ASes agree to exchange traffic between their own networks and their respective customers at no charge. This is typically done at Internet Exchange Points (IXPs) — physical facilities where many networks connect to exchange traffic efficiently.
Customer: The inverse of transit — a larger AS accepts payment to provide internet access to a smaller AS.
How a packet finds its path
When your ISP's router receives a packet destined for 142.250.80.1 (a Google IP), it consults its BGP routing table. That table contains entries learned from BGP peers — each entry says "to reach prefix X.X.X.X/Y, send traffic toward AS-number Z." The router selects the best path based on BGP path attributes (AS path length, local preference, MED, etc.) and forwards the packet accordingly.
The AS path — the sequence of ASNs a route has traversed — is visible in BGP and is part of what a BGP lookup returns. It's also why traceroute hops often correspond to AS boundaries: latency typically jumps when a packet crosses from one AS to another.
ℹ️ Note: BGP is a policy-based protocol, not purely a shortest-path protocol. An AS can prefer a longer physical path for commercial or policy reasons. This is why internet traffic sometimes routes counterintuitively — through a third country or over a longer geographic path than geography would suggest.
Who Assigns ASNs and How to Get One
ASNs are assigned by Regional Internet Registries (RIRs) — the same organisations that manage IP address allocation. There are five RIRs covering different global regions:
| RIR | Full Name | Region Covered |
|---|---|---|
| ARIN | American Registry for Internet Numbers | North America |
| RIPE NCC | Réseaux IP Européens Network Coordination Centre | Europe, Middle East, Central Asia |
| APNIC | Asia-Pacific Network Information Centre | Asia-Pacific |
| LACNIC | Latin America and Caribbean Network Information Centre | Latin America, Caribbean |
| AFRINIC | African Network Information Centre | Africa |
To obtain an ASN, an organisation applies to its regional RIR, demonstrating a technical justification — typically that they connect to two or more upstream providers (multihoming) or operate infrastructure that requires independent routing policy. The application process and fees vary by RIR.
The WHOIS database maintained by each RIR contains the registration record for every ASN — including the organisation name, contact information, and the IP prefixes that AS announces. This is the data an ASN lookup retrieves.
How to Look Up an ASN
Via command line
# Look up the ASN for a specific IP address using whois
whois 8.8.8.8
# More targeted — query the routing registry directly
whois -h whois.radb.net 8.8.8.8
# Use dig to query the Cymru IP-to-ASN mapping service
dig +short 8.8.8.8.origin.asn.cymru.com TXT
# Returns: "15169 | 8.8.8.0/24 | US | arin | 1992-12-01"
# Look up details for a known ASN number
whois -h whois.radb.net AS15169
# Find all prefixes announced by an ASN
whois -h whois.radb.net '!gAS13335'
The Cymru IP-to-ASN service (asn.cymru.com) is a DNS-based lookup that returns the ASN, prefix, country code, RIR, and allocation date for any IP address — useful for scripting bulk lookups.
Via our ASN Lookup tool
Use our ASN Lookup to look up the ASN, organisation name, registered prefixes, and RIR for any IP address or ASN number directly — no command line required. The result also links through to the full RIR WHOIS record for the registrant.
Via BGP route views
For deeper BGP path analysis — including the full AS path to a prefix and all peer announcements — services like bgp.he.net (Hurricane Electric's BGP toolkit) and bgpview.io provide detailed routing table data pulled from real BGP route collector nodes distributed globally.
What an ASN Lookup Result Tells You
A typical ASN lookup for an IP address returns the following fields:
IP Address: 8.8.8.8
ASN: AS15169
Organisation: Google LLC
Prefix: 8.8.8.0/24
Country: US
RIR: ARIN
Allocated: 1992-12-01
Each field has a specific meaning and use in triage:
ASN — The autonomous system number. Use this to identify the network operator and look up all other prefixes they announce.
Organisation — The legal entity that registered the ASN. For cloud providers and hosting companies, the organisation name tells you the platform (AWS, DigitalOcean, OVH, Hetzner, etc.). For ISPs, it identifies the carrier. For suspicious IPs, this is often your first signal about whether traffic is coming from residential broadband, a datacenter, or a known VPN/proxy provider.
Prefix — The IP address block (CIDR notation) that this IP belongs to within the AS's announcement. A /24 prefix covers 256 addresses; a /16 covers 65,536. Knowing the prefix tells you the scope of the address block and helps contextualise whether multiple IPs share the same infrastructure.
Country — The country where the prefix is registered, per the RIR record. This is the RIR registration country, not necessarily a geolocation — large providers register IP blocks in their headquarters country even when those IPs serve traffic from data centres globally. For accurate geographic placement of where traffic is actually originating or terminating, use IP geolocation data alongside ASN data.
RIR — Which Regional Internet Registry allocated this ASN. For incident response and abuse reporting, the RIR determines where to submit abuse complaints for non-responsive providers.
Allocated — The date the ASN or prefix was allocated. Very recently allocated prefixes showing up in abuse logs can be a signal worth investigating — freshly allocated address space appearing in attack traffic is a common pattern.
Practical Use Cases for ASN Lookups
Traceroute hop identification
When reading a traceroute, hops that show only an IP address (no reverse DNS hostname) can be identified using an ASN lookup. Knowing that hop 9 belongs to AS1299 (Telia Carrier) tells you exactly which transit provider is handling that segment of the path — essential when escalating a routing problem to the right carrier.
See our How to Read a Traceroute guide for the full workflow of combining traceroute output with ASN context to identify which network operator owns a failing hop.
Abuse and incident triage
When an IP address appears in access logs exhibiting malicious behaviour — brute force, scraping, DDoS participation — an ASN lookup immediately identifies the hosting provider or ISP. This tells you where to send an abuse report and what type of response to expect. Datacenter ASNs (AWS, Hetzner, OVH) typically have active abuse desks. Residential ISP ASNs may have end-user terms of service to reference. Some ASNs have a documented history of abuse-tolerant hosting and no functional abuse contact.
Cloud and CDN traffic classification
If you're auditing server logs for traffic patterns, ASN data lets you quickly separate categories of traffic: Googlebot and other crawlers (Google's AS15169, Bing's AS8075), CDN edge nodes (Cloudflare's AS13335, Fastly's AS54113, Akamai's AS20940), cloud-hosted clients (AWS AS16509, Azure AS8075, GCP AS15169), and residential/mobile users (ISP ASNs). This segmentation is useful for bot detection, rate limiting strategy, and traffic analysis.
Geolocation validation
IP geolocation databases map IP addresses to physical locations — but those databases can be inaccurate, particularly for addresses recently reassigned or belonging to large providers with globally distributed infrastructure. An ASN lookup provides a ground-truth answer about who owns the address block, which you can cross-reference against the claimed geolocation. If an IP claims to be in Germany but belongs to an ASN registered in Russia with no German presence, that's a data quality signal worth flagging.
BGP routing anomaly detection
Large-scale BGP route hijacking events — where an AS incorrectly announces another AS's prefixes — show up as ASN mismatches between what you'd expect for a given IP prefix and what's actually being announced. Monitoring ASN-to-prefix mappings for your own address space is a basic BGP security practice: if your prefix suddenly shows up as announced by an unfamiliar ASN, it's a hijacking incident.
ASN Lookup vs IP Geolocation — Key Differences
These two tools answer different questions and should be used together rather than interchangeably.
| ASN Lookup | IP Geolocation | |
|---|---|---|
| Question answered | Who owns this IP? | Where is this IP located? |
| Data source | RIR WHOIS + BGP routing tables | Commercial geolocation databases |
| Accuracy | Very high — registry data is authoritative | Variable — country level reliable, city level less so |
| What it returns | Organisation, ASN, prefix, RIR, allocation date | Country, region, city, latitude/longitude, ISP label |
| VPN/proxy effect | Shows the VPN provider's ASN | May show VPN server location or origin location |
| Best used for | Network triage, abuse reporting, traffic classification | User location inference, CDN routing, fraud signals |
For a deep dive into how geolocation databases are built and where they fail, see our IP Geolocation Explained guide.
💡 Tip: For thorough IP triage, always run both an ASN lookup and an IP geolocation lookup together. ASN data tells you who operates the network; geolocation data gives you the claimed physical location. Discrepancies between the two — or between either and the claimed origin of traffic — are worth investigating.
Use our IP Lookup tool to retrieve both ASN data and geolocation data for any IP address in a single query.
Frequently Asked Questions
Q: Can I look up the ASN for an IPv6 address?
Yes. ASN lookups work identically for IPv4 and IPv6 addresses. The Cymru DNS-based lookup method uses a reversed IPv6 address format: dig +short [reversed-ipv6].origin6.asn.cymru.com TXT. Most ASN lookup tools handle IPv6 transparently without any format changes required from you.
Q: Why does the same company have multiple ASNs?
Large organisations often accumulate multiple ASNs through acquisitions, geographic expansion, or operational segmentation. Google operates dozens of ASNs globally — AS15169 is the most visible, but Google also uses AS36492, AS36384, AS19527, and others for different services and regions. Each ASN can announce different IP prefix sets and carry different routing policies. When doing ASN-based traffic classification, always check whether a provider operates multiple ASNs and include all of them in your filter sets.
Q: What's the difference between an ASN and an IP address block?
An ASN is an identifier for a network operator — it says nothing directly about which IP addresses that operator uses. The IP address blocks (prefixes) an AS announces are linked to the ASN through BGP routing advertisements and through WHOIS records, but an AS can announce multiple different prefix blocks, and a prefix can technically be announced by more than one AS (though this usually only happens during BGP hijacking incidents or certain anycast configurations).
Q: My IP address shows the wrong ASN in some tools — why?
ASN data comes from BGP routing tables and RIR WHOIS records, which may not always be in sync. Recently reallocated address blocks, sub-allocated IP ranges (where a provider assigns a sub-block to a customer who doesn't run their own AS), and misconfigurations in route registries can all cause inconsistencies between tools. If you need authoritative data, query the relevant RIR's WHOIS directly rather than relying on a third-party aggregator.
Q: How do I find all IP prefixes announced by a specific ASN?
Run whois -h whois.radb.net '!gAS[number]' from the command line, replacing [number] with the ASN without the "AS" prefix. Services like bgpview.io and bgp.he.net also provide prefix lists for any ASN through a web interface, including historical prefix announcements and peer relationships. Our ASN Lookup tool surfaces the primary registered prefixes from WHOIS records.
Q: What should I do if I find my own IP prefix being announced by a foreign ASN?
This is a BGP route hijacking incident. Immediately contact your upstream transit providers and ask them to filter the illegitimate announcement. File an abuse report with the RIR responsible for the hijacking ASN. Contact the network operator of the hijacking AS directly if their abuse contact is reachable. Document the event with BGP route collector snapshots from services like bgpstream.caida.org for evidence. The RPKI (Resource Public Key Infrastructure) system, which cryptographically validates route announcements, can prevent hijacking — check whether your prefixes have ROA (Route Origin Authorisation) records published.
Next Steps
For putting ASN data into practice during live network diagnostics, see our How to Read a Traceroute guide — it covers how to identify which carrier owns a specific hop and how to use that information for escalation.
To understand the geographic dimension of IP address data alongside ASN ownership, read our IP Geolocation Explained guide which covers how geolocation databases are built, their accuracy limits, and when they fail.
Run an ASN Lookup or IP Lookup on any address to see the full ownership and routing context immediately.
Browse all IP guides on DNSnexus for related tools and techniques.