What is an ASN? Autonomous System Numbers Explained

RFC 1930 describes an autonomous system as a connected group of IP prefixes run by one or more network operators with a single, clearly defined routing policy. The important words are "single routing policy": an AS is not defined by size or by company, but by the fact that the rest of the internet can treat it as one unit when deciding how to reach its addresses.

In practice one organization usually has one ASN, even if it operates in many countries. Large organizations sometimes run several (for example after acquisitions, or to separate a content network from an access network), and small organizations without their own routing policy have none at all - their addresses are announced by their provider's AS.

The ASN appears in two places in BGP. It identifies the two sides when a session is set up, and it is added to the AS-path of every route an AS passes on. The last ASN in a path is the origin AS: the network that announced the prefix in the first place. That is why "which ASN is this IP in?" is the first question in almost every network investigation.

The original ASN space was 16 bits wide, allowing numbers from 0 to 65535. As the internet grew that pool ran low, so RFC 4893 (now RFC 6793) extended it to 32 bits, allowing numbers up to 4294967295. Today the registries assign mostly 32-bit numbers, which is why recently registered networks typically have six-digit numbers or larger, while long-established networks hold low numbers.

32-bit ASNs can be written in two notations (RFC 5396). The plain form (asplain) is the decimal number. The older asdot form splits it into the high and low 16 bits:

Routers that do not understand 4-byte ASNs see the placeholder AS23456 (AS_TRANS) in place of a 32-bit ASN, while the real path travels in a separate attribute. Seeing AS23456 in a path on a modern router means the 4-byte path could not be reconstructed, which points to old software or a misconfiguration somewhere along the way.

Not every number is a real network. Several ranges are reserved by RFC and must never appear as an origin in the global routing table:

Private ASNs are the ASN equivalent of RFC 1918 addresses. They are fine inside a network or between a customer and a single provider - many single-homed customers run BGP with their ISP using a private ASN, which the ISP removes before announcing the routes onward. If a private ASN shows up in a path on the public internet, someone forgot to strip it.

Public ASNs come from the Regional Internet Registry that serves your region: AFRINIC, APNIC, ARIN, LACNIC or RIPE NCC. IANA hands blocks of numbers to the RIRs; the RIRs assign individual numbers to organizations, either directly to members or through sponsoring LIRs and national registries, depending on the region.

Policies differ between the registries. Several still ask for a routing need, typically that you plan to connect to more than one other network (multihoming) or have another technical reason why your routing must differ from your provider's; the RIPE NCC removed its multihoming requirement in 2014 (policy proposal 2014-03), so check your registry's current policy. The usual steps are:

1. Open an account with your RIR (in most regions this means becoming a member and signing its service agreement) or, where the RIR allows it, have an existing member such as a sponsoring LIR request the ASN on your behalf.
2. Prepare the justification: who your upstream providers or peers will be and why you need your own policy.
3. Submit the request through the RIR portal or your sponsor. The RIR creates the registration (in some regions an aut-num object in its database).
4. Configure BGP with your providers, publish routing information (IRR route objects and RPKI ROAs for your prefixes) and, ideally, an ASPA object listing your providers.

ASNs can also change hands: the registries publish ASN transfers in the same logs as IP address transfers, which you can browse in the transfer statistics.

To find the ASN behind an IP address, look the address up: the origin AS of the most specific announced prefix is the network that routes it. From a terminal:

$ curl ipctl.io/ip/8.8.8.8/asn
AS15169

To see what an ASN is, use the ASN lookup or the registry's own whois service. The RIR record tells you who holds the number; routing data tells you what the network actually does:

$ curl ipctl.io/as/24940
AS:              AS24940
Name:            HETZNER-AS Hetzner Online GmbH
Country:         DE
RIR:             RIPENCC
Status:          allocated
...

$ whois -h whois.ripe.net AS24940

An ASN page such as AS24940 combines both views: the registration (holder, country, registry, allocation date) and the live routing picture - the prefixes the AS announces, how much address space that is, its RPKI coverage, its upstream providers and its published ASPA.

Because every routed IP address belongs to a prefix and every prefix has an origin AS, the ASN is the natural pivot point for investigating who runs a piece of the internet:

• Abuse handling: the ASN leads to the operator and its abuse contact, and shows whether an address belongs to a hosting provider, an access network or a content network.
• Routing troubleshooting: the AS-path shows which networks traffic crosses, and unexpected origins point to hijacks or misconfigurations.
• Peering and transit decisions: an ASN's prefix count, address space and upstreams show how large a network is and how it is connected.
• Security posture: RPKI coverage and a published ASPA show how carefully a network protects its own routes.