What Is an Autonomous System? ASNs, ASN Data and Lookup Explained

RFC 1930, Guidelines for creation of an AS, defines an Autonomous System (AS) as “a connected group of one or more IP prefixes run by one or more network operators that have a single and clearly defined routing policy”. Each AS is identified by an Autonomous System Number (ASN), and the registry data attached to that number tells you who operates the network behind any IP address.

Concretely, an Autonomous System is a collection of routers under one administrative control that decides how one or more blocks of IP addresses, called IP prefixes, are routed. ISPs, cloud providers, universities, large companies and even divisions of companies run their own. Apple, Cloudflare, Comcast, Google, Microsoft, Orange and MIT all operate one or more Autonomous Systems.

The Internet works by routing IP packets inside an AS, and between Autonomous Systems. This article covers both sides: what an AS is and how it gets its number, then what ASN data reveals about an IP address and how to look it up.

How is an Autonomous System identified?

An organization that registers an Autonomous System receives a globally unique Autonomous System Number. The number is used when exchanging routing information with neighboring networks, and as the identifier of the AS itself. It is written with the prefix AS, as in AS13335 for Cloudflare.

ASNs were originally 16-bit integers, which allowed at most 65,536 of them. 32-bit ASNs were introduced in 2007 and allow up to 4,294,967,295. More than 100,000 ASNs have been assigned to date, and roughly 80,000 of them announce prefixes in the global routing table at any given time. Like IP addresses, some ASNs are reserved or private and never appear on the public Internet.

Who assigns Autonomous System Numbers?

The Internet Assigned Numbers Authority (IANA) coordinates ASNs globally, along with IP addresses and the DNS root. IANA does not hand numbers to organizations directly. It delegates blocks to the five Regional Internet Registries (RIRs), which manage Internet number resources for their part of the world:

• African Network Information Center (AFRINIC)
• American Registry for Internet Numbers (ARIN)
• Asia-Pacific Network Information Centre (APNIC)
• Latin American and Caribbean Network Information Centre (LACNIC)
• Réseaux IP Européens Network Coordination Centre (RIPE NCC)

To obtain an ASN you apply to the RIR serving your region, in most cases through a sponsoring member (an LIR in the RIPE region). Each RIR documents its procedure, for instance ARIN’s ASN request guide. Ipregistry is a RIPE NCC member and handles ASN registration for organizations that do not want to become a member themselves.

How do Autonomous Systems talk to each other?

Inside an AS, routers use an interior gateway protocol such as OSPF, IS-IS or EIGRP to move packets between nodes. That is intra-domain routing, and it is entirely the operator’s business.

Between Autonomous Systems, every network on the Internet speaks the same protocol: the Border Gateway Protocol (BGP). Each AS announces the prefixes it originates to its neighbors, and each neighbor passes the announcement on, prepending its own ASN. A route therefore carries an AS path, the list of networks a packet would traverse to reach the prefix. When a router knows several paths to the same prefix, it picks one according to local policy: commercial agreements first, then usually the shortest AS path.

Most ASes are not directly connected. Traffic between two networks with no link between them crosses one or more transit ASes that agree, for a fee, to carry it. Networks that exchange traffic at no cost are said to peer, often at an Internet Exchange Point. Together these relationships form the graph that is the Internet.

BGP is built on trust. A network can announce a prefix it does not own, and unless its neighbors filter the announcement, traffic follows. That is a BGP hijack, and RPKI exists to let networks check that the origin AS is authorized to announce a prefix.

What organizations run Autonomous Systems?

Internet Service Providers are the best-known operators of ASNs: AT&T, Comcast, Free, Orange, SFR, Telefónica. They hold blocks of IP addresses allocated by their RIR and hand individual addresses to subscribers. Your home connection’s IP address sits inside one of those blocks. Customers of the French ISP SFR, for instance, get addresses announced by AS8228, whose largest route, 78.112.0.0/12, spans 78.112.0.0 to 78.127.255.255.

Hosting and cloud providers such as AWS, Azure, Google Cloud, Hetzner, OVHcloud and Oracle Cloud need vast pools of addresses to give every virtual machine a public IP. AWS alone announces well over a hundred million IPv4 addresses, a few percent of the entire IPv4 space.

Content networks and enterprises round out the list: Apple, Cloudflare and Netflix run ASes to control how their traffic reaches users, and plenty of smaller companies register one to keep their offices on address space they control, which simplifies security policy and lets them change ISPs without renumbering.

What can you learn from ASN data?

ASNs make the Internet route, but you do not need to understand BGP to benefit from them. What matters is the association they create between a block of IP addresses and an organization. Given an IP address, the registry and routing data behind its ASN tells you who operates the network. That turns an anonymous address into something you can reason about.

Who is visiting my website?

The most common use of ASN data is understanding where traffic comes from. Combined with IP geolocation, it tells you which ISPs, mobile carriers, universities and companies your visitors use. The “network” or “service provider” dimension in analytics tools is ASN data.

Could this IP address be malicious?

ASN data is one of the cheapest bot and fraud signals there is. If a burst of login attempts comes from addresses announced by hosting providers rather than consumer ISPs, someone is running scripts on rented servers against your users’ accounts. A payment or signup from a datacenter AS deserves a closer look before it is trusted. Ipregistry classifies every AS by usage type (ISP, hosting, business, education, government, cdn, and so on), and its threat detection adds VPN, proxy and Tor signals on top.

Who is serving this website?

A DNS lookup gives you the addresses behind a domain, and the ASN behind those addresses tells you who hosts it. dig +short ipregistry.co followed by a lookup of the result reveals the hosting provider or CDN, which is a useful first step when assessing whether a site is what it claims to be.

Which prefix should I block or allow?

Because an AS announces whole prefixes, ASN data tells you the routing boundary an address belongs to. During an attack, filtering the announced prefix (or the whole AS) is often more effective than chasing individual addresses. The same logic applies in reverse when allowlisting a partner’s network. Our CIDR notation guide explains how to read those prefixes.

How to look up ASN data

There are several ways to look up the ASN of an IP address, with different trade-offs. To keep the examples consistent, every lookup below uses 104.16.132.229, an address serving cloudflare.com.

Whois

Whois is the original registry lookup tool and ships with every Unix and Windows system. Run it against an IP address and it queries IANA, which redirects to the RIR holding the record:

$ whois 104.16.132.229

NetRange:       104.16.0.0 - 104.31.255.255
CIDR:           104.16.0.0/12
NetName:        CLOUDFLARENET
NetHandle:      NET-104-16-0-0-1
Parent:         NET104 (NET-104-0-0-0-0)
NetType:        Direct Assignment
OriginAS:       AS13335
Organization:   Cloudflare, Inc. (CLOUD14)
RegDate:        2014-03-28
Updated:        2017-02-17
Ref:            https://rdap.arin.net/registry/ip/104.16.0.0

OrgName:        Cloudflare, Inc.
OrgId:          CLOUD14
Address:        101 Townsend Street
City:           San Francisco
StateProv:      CA
PostalCode:     94107
Country:        US
...

The record comes from ARIN and shows the allocation, the holder and, in the OriginAS field, the ASN: AS13335. Whois is authoritative but verbose, and the field names differ from one RIR to another, which makes it awkward to parse programmatically.

Team Cymru

Team Cymru runs a whois-compatible service that answers with just the routing data. Point whois at whois.cymru.com:

$ whois -h whois.cymru.com 104.16.132.229
AS      | IP               | AS Name
13335   | 104.16.132.229   | CLOUDFLARENET, US

The output is short and structured, and it supports bulk queries. It is limited to the ASN, the AS name and the country, so you will need another source for anything richer.

PeeringDB

PeeringDB is where network operators publish how and where they peer. It cannot look up an IP address, but once you have the ASN it holds a detailed profile of the operator: facilities, exchange points, traffic levels, peering policy and contacts. Cloudflare’s profile lives at https://www.peeringdb.com/asn/13335.

PeeringDB also has an API, though there is no direct ASN endpoint. Find the network ID first, then fetch the record:

$ curl --write-out "%{redirect_url}\n" "https://www.peeringdb.com/search?q=AS13335"
https://www.peeringdb.com/net/4224

$ curl https://www.peeringdb.com/api/net/4224
{"data": [{"id": 4224, "org_id": 4715, "org": {"id": 4715, "name": "Cloudflare", "website": "https://www.cloudflare.com/", ...

CAIDA AS Rank

CAIDA’s AS Rank orders every AS by the size of its customer cone, the set of networks reachable by following customer links downward. It is the reference for measuring how influential a network is in the routing graph. AS Rank searches by ASN, not IP address. At the time of writing AS13335 ranks 64th, with a cone of 963 ASes and about 35,000 prefixes. The top spot belongs to AS3356, Lumen (formerly Level 3).

The data is available through REST and GraphQL APIs:

$ curl https://api.asrank.caida.org/v2/restful/asns/13335

{
  "data": {
    "asn": {
      "rank": 64,
      "asn": "13335",
      "asnName": "CLOUDFLARENET",
      "source": "ARIN",
      "cone": {
        "numberAsns": 963,
        "numberPrefixes": 35738,
        "numberAddresses": 32408873
      },
      "country": { "iso": "US" },
      "asnDegree": {
        "total": 1536,
        "customer": 962,
        "peer": 423,
        "provider": 151
      }
    }
  }
}

Ipregistry lookup pages

Every Autonomous System, every announced prefix and every IP address has a page on Ipregistry that you can open without an API key. The AS13335 page lists Cloudflare’s 2,700-plus IPv4 ranges and 3,400-plus IPv6 ranges, its WHOIS record, and its peers, upstreams and downstreams. Each range links to its own subnet page, such as 104.16.128.0/20, and each address to its own page, such as 104.16.132.229, with geolocation and threat data. This is the quickest way to answer “who runs this network and what else do they announce” by hand.

Ipregistry API

For anything automated, the Ipregistry API returns ASN data with a single HTTP request, and enriches it with the organization’s domain and a usage type that tells you whether the network is an ISP, a hosting provider, a business, a CDN or something else:

curl "https://api.ipregistry.co/104.16.132.229?fields=connection&key=YOUR_API_KEY"

{
  "connection": {
    "asn": 13335,
    "domain": "cloudflare.com",
    "is_anycast": true,
    "organization": "Cloudflare, Inc.",
    "route": "104.16.128.0/20",
    "type": "hosting"
  }
}

The same request can return geolocation, company, carrier, currency, time zone and threat data for the address, so one lookup answers every question in the previous section at once. Try it with your own address at api.ipregistry.co/?key=tryout.

Conclusion

An Autonomous System is the unit the Internet routes by, and its number is the key that links an IP address to the organization operating it. That link is what makes ASN data valuable far beyond network engineering: it tells you where your traffic comes from, whether an address belongs to a consumer or a rented server, and who is behind a site. Whois and Team Cymru give you the number, PeeringDB and CAIDA describe the network, and an IP data API brings all of it together with location and threat context in one call. Pick the tool that matches how often, and how programmatically, you need the answer.