Autonomous Systems and ASNs Explained

What an ASN looks like

ASNs began as 16-bit numbers, from 0 to 65535. As that pool ran low, RFC 6793 extended them to 32 bits, so today they run from 0 to 4,294,967,295. They are usually written as a plain number with an AS prefix, such as AS64500. RFC 5396 also defines “asdot” notation, which writes a 32-bit number as two 16-bit halves: AS1.10 is the same as AS65546.

Some ranges never belong to a real network on the public internet:

The examples in this article use the documentation ranges and documentation addresses, so none of them point at a real network.

Who hands out ASNs

IANA allocates blocks of ASNs to the five Regional Internet Registries (RIRs): AFRINIC, APNIC, ARIN, LACNIC and the RIPE NCC. Each RIR assigns numbers to organizations in its region, the same way it assigns IP address space, and publishes who holds each one in its registration database, which you can query over WHOIS or RDAP. WHOIS vs RDAP explains the difference.

Not every network needs its own ASN. RFC 1930 sets the long-standing rule: you need one when you connect to more than one other network and your routing policy differs from your providers’. A small business with one internet provider simply uses that provider’s AS. Registries apply similar tests: ARIN, for example, asks for a plan to multihome or a unique routing policy.

Prefixes: what an AS announces

An AS tells the internet which addresses it can deliver to by announcing prefixes in BGP, such as 203.0.113.0/24 or 2001:db8:100::/40. The AS that first announces a prefix is its origin AS. Every network that passes the route on adds its own ASN to the front of the AS path, so a route that reached you as 64501 64502 64510 started at AS64510 and crossed AS64502 and AS64501 on the way.

How big a prefix can be announced is a matter of convention. Many networks drop IPv4 routes longer than /24 and IPv6 routes longer than /48 to keep the global table manageable, which RFC 7454 discusses. That is why so many announcements are exactly /24 or /48: networks split their space to those sizes to steer traffic between locations.

An address can also sit inside more than one announced prefix, a large block from one AS and a smaller, more specific one from another. Routers always forward on the longest match, so the more specific route wins. That rule is useful for traffic engineering and dangerous in a hijack, as BGP Hijacks and RPKI explains.

Upstreams, peers and downstreams

Networks connect under a few kinds of agreement:

These agreements are private, so nobody outside can see them directly. What is public is the AS paths that route collectors record. If AS64501 always appears between AS64510 and the rest of the internet, it is probably an upstream of AS64510; if AS64520 always appears behind AS64510, it is probably a customer. Researchers infer relationships this way, for example in CAIDA’s AS Rank, but the inference is a best guess. A peer can look like an upstream, and a network seen from only a few vantage points can be misread.

The number of upstreams says a lot about resilience. A network with one upstream goes dark when that link fails. Two or more upstreams, ideally from different providers, keep it reachable.

Why ASNs matter for DNS and security

• Who really hosts a name. Looking up the ASN for a domain’s address tells you which network carries its traffic: a cloud provider, a CDN, or the organization itself.
• Name server diversity. Name servers in different prefixes but the same AS still share one routing policy and one set of upstreams. Multi-provider DNS is only as diverse as the networks behind it.
• Abuse and reputation. Blocklists and threat reports often name the ASN behind an address. The AS holder’s registry record lists the contact for abuse reports.
• Route security. RPKI route origin authorizations name the ASN allowed to originate each prefix. RPKI Explained covers how to publish them.

How DNS Panopticon helps

The ASN Lookup takes an AS number, an IP address, a prefix or a domain. It shows who holds the AS, every prefix it announces with a chart of their sizes, a graph of its upstream and downstream neighbours, and, for an address, the prefix it sits in, the origin AS and whether RPKI says that origin is allowed. Website Recon shows the origin AS for each address a website uses.