What is an ASN? Networks and ISPs explained

What an ASN is#

The internet is not one network. It is tens of thousands of separate networks, run by ISPs, cloud providers, universities, companies and content networks, that agree to pass each other's traffic. Each of those networks is an autonomous system (AS): a set of IP blocks under one routing policy, run by one organisation. Each is identified by an autonomous system number, or ASN, written AS15169 or just 15169.

An ASN is to a network what an IP address is to a connection: a registered identifier that other networks use to refer to it. The original numbers were 16 bits, which ran short in the same way IPv4 did, so ASNs are now 32 bits (RFC 6793). Numbers are allocated by the same regional registries that allocate addresses.

How it fits with routing#

Networks tell their neighbours which IP blocks they can reach using the Border Gateway Protocol (RFC 4271). A network announces a block, such as 1.1.1.0/24, together with its own ASN, and its neighbours pass the announcement on with their ASNs added to a growing list called the AS path. A router picking a route to an address looks for the most specific announced block that contains it and follows the best path toward the network that announced it.

• The block says which addresses.
• The ASN says which network is announcing them.
• The AS path says which networks the traffic will cross to get there.

That is why a lookup shows a route next to the ASN: the announced block your address falls inside. Two addresses in the same route are, for routing purposes, in the same place.

ASN, ISP and organisation: three different things#

An ISP is a company that sells connectivity. An ASN is a routing identity. Most ISPs have one or several ASNs, but the mapping is not one to one:

• A large ISP may run several ASNs, for different regions or acquired companies.
• A small ISP may have none, buying transit from a larger one and using its address space.
• Non-ISPs have them too: cloud providers, content delivery networks, universities, governments and big companies all run their own.
• The organisation a lookup lists is who the registry says holds the block, and the ASN is who announces it. They are usually the same and sometimes deliberately not, for example when a block is registered to one party and run by another under agreement.

Why the ASN is more reliable than the location#

A city is an estimate. An ASN is a fact that can be checked from public routing data: the network is announcing the block or it is not. That makes it the best single field for one question that matters to fraud teams, network operators and anyone reading a log: what kind of network is this address on?

• A residential ISP's ASN suggests a home connection, so it is likely a person.
• A cloud or hosting provider's ASN suggests a server: a bot, a scraper, a VPN exit or a cloud service. This is what a VPN, proxy and Tor check looks at first.
• A mobile carrier's ASN suggests a phone, and probably shared, behind carrier-grade NAT.
• A university or company ASN suggests an organisation's network, where many people share addresses.

It is also the right place to start when an address turns up on a blocklist: the ASN tells you whose network it is, and the blacklist check tells you which lists it is on and how to ask for removal.

Looking up an ASN#

Every lookup reports the ASN, the name registered to it and the route. To go the other way and list every block an ASN announces, or its neighbours, use a routing registry or a BGP looking-glass service. The authoritative record of who holds which number is the IANA AS numbers registry. Private-use numbers (64512 to 65534, and a range in the 32-bit space) are reserved for internal use and never appear on the public internet (RFC 6996).

Common questions#