What is an ASN?

The internet is not one network but a federation of tens of thousands of them, each run by a different organization and each deciding for itself how to route traffic. Every one of those networks has a number. That number is the ASN, and it is the single most useful fact you can learn about an IP address, because it tells you who actually operates the connection rather than merely who owns the block on paper.

This article explains what an autonomous system is, how ASNs and prefixes fit together, why the ASN behind an address drives both its reputation and its location, and how to look one up.

Autonomous systems in one paragraph

An autonomous system is a collection of IP address ranges under a single technical administration with a single, consistent routing policy. An internet provider is one, a cloud company is one, a university, a bank with its own connectivity or a content network is one. Each is assigned an autonomous system number and uses it when it tells the rest of the internet which addresses it can deliver traffic to. "Autonomous" means exactly that: inside its own network the organization routes however it likes; the ASN is how it presents itself to everyone else. The glossary definition is under ASN.

How the numbers are assigned

	Detail
Original size	16 bits, 0 to 65,535
Extended size	32 bits since 2007, 0 to 4,294,967,295; written as a plain number, for example AS4200000001
Who assigns	The global numbering authority delegates blocks to the 5 regional registries, which assign numbers to organizations that justify a need
Private use	64512 to 65534 and 4200000000 to 4294967294, never announced publicly, used inside networks and between a customer and a single provider
Documentation	64496 to 64511 and 65536 to 65551, reserved for examples like the ones in this article
Reserved	0, 23456 (a placeholder used during the 16-bit to 32-bit transition), 65535 and 4294967295

Getting an ASN requires an organization to be connected to at least 2 other networks, or to have a routing policy distinct from its provider's, and to register with the regional registry for its part of the world. The registry records the holder's name, country and contacts, which is the data a WHOIS or RDAP lookup returns.

Prefixes: what an AS announces

An autonomous system does not announce individual addresses; it announces prefixes, which are blocks written in CIDR notation. 203.0.113.0/24 is 256 IPv4 addresses, 2001:db8::/32 is an enormous IPv6 block. The number after the slash says how many leading bits are fixed, so a smaller number means a larger block.

The announcement itself travels over the Border Gateway Protocol. Each network tells its neighbors "I can reach these prefixes", attaching its own ASN to the path; the neighbors pass the announcement on, adding their ASN in turn. A router anywhere in the world ends up with a table of every announced prefix and the chain of ASNs leading to it, and picks the best path for each. That table is public: route collectors around the world record it, and it is the source of the "announced by" line on every IP lookup.

A few consequences follow from this design:

• An address belongs to whoever announces it right now. The registry says who was allocated the block; the routing table says who is routing it. They usually agree, but leased and reassigned blocks make them differ, and the announcing network is what matters for traffic.
• The smallest prefix most networks accept is a /24 for IPv4. Anything more specific is usually filtered, which is why address blocks are traded in multiples of 256.
• Announcing a prefix you do not hold is possible. That is a route hijack, and the countermeasure, RPKI, lets holders publish a signed statement of which ASN may announce their prefixes so that other networks can drop invalid announcements.

Why the ASN decides reputation

Websites and anti-abuse systems judge an address by the company it keeps, and the ASN is the company. Three things are derived from it.

Network type. The organization behind the ASN is a consumer provider, a mobile carrier, a hosting or cloud company, a business, a university or a government body. Every address it announces inherits that type, so an address from a hosting ASN is a datacenter IP and an address from a consumer ASN is a residential IP, before anything else about it is known. The article on residential, datacenter and mobile addresses covers how that classification is made and what it signals.

Shared history. Abuse is tracked per address, but it is also aggregated per network. A hosting ASN that tolerates spam and attack traffic earns a reputation that lands on every customer, including new and innocent ones, and some blocklists publish entire ASNs rather than ranges. Conversely, a large consumer ASN's addresses are given the benefit of the doubt because blocking them would block households.

Expected behavior. A system that knows an address comes from a mobile carrier expects it to be shared by many people and to change often; one that knows an address comes from a cloud ASN expects a server and treats a login attempt from it as unusual. The expectations come from the ASN, not from the address.

This is why the ASN is the first thing our IP checker reads and why a residential and a datacenter address with identical blocklist results get different verdicts.

Why the ASN matters for geolocation

The registry records a country for each ASN, and for most networks that is the country where every address is used. Large and multinational networks break the rule: a cloud company registered in one country announces prefixes it operates on every continent, and a carrier may serve several countries under one ASN. Location data therefore comes from the prefix level, where the network's own registration, published geofeeds and latency measurements place each block, with the ASN as the fallback and the sanity check. When an address's prefix is placed in one country and its ASN is registered in another, IP geolocation is less certain, and a careful result says so.

Anycast adds one more wrinkle: the same prefix is announced from many places at once, and traffic goes to the nearest. Those addresses have no single location at all, which is why large public resolvers and content networks appear to be everywhere.

Reading an ASN record

A lookup of a network returns a handful of fields. Using a documentation number as the example:

Field	Example	What it tells you
ASN	AS64496	The identifier
Name	EXAMPLE-NET	The registry name, often an abbreviation of the organization
Organization	Example Networks Ltd	The legal holder
Country	The registration country	Where the organization is registered, not necessarily where each prefix is used
Type	Consumer ISP, hosting, mobile, business, education, government	A classification derived from the name, registry data and datacenter lists
IPv4 prefixes	12 prefixes, 48,640 addresses	Size of the network and what it announces
IPv6 prefixes	3 prefixes	Whether the network has deployed IPv6
Registered	A date	When the number was assigned
Contacts	Abuse and technical addresses	Where to report abuse from the network

The abuse contact is the practical one: if an address from this network is attacking you or sending spam, that mailbox is where the report goes, and it is published precisely so that it can be used.

How to look up an ASN

There are 3 directions you may need.

1. From an IP address to its ASN. Enter the address in the ASN lookup and the result names the announcing network, its type, its country and the prefix the address falls in. Leave the box empty to see your own connection's network, which answers "what is my ISP" more precisely than the ISP's marketing name does. The IP lookup shows the same ASN line as part of the full profile.
2. From an ASN to its details and prefixes. Enter the number, with or without the AS prefix, in the same tool. The result lists every announced prefix, from the public routing table, with the registration record from the regional registry. Every network also has its own page under the ASN directory, which can be browsed by size and country.
3. From an ASN or address to its registration. The WHOIS lookup queries the registries over RDAP and returns the holder, status, contacts and, for IP blocks, the parent allocation. Use it when the routing data and the registry disagree, which is the signature of a leased or reassigned block.

From the command line, the registries' RDAP services return the same record as JSON, and public route-collector projects publish the full routing table for anyone who wants to process it. Our tool combines the 2 so that the answer is one page.

What an ASN cannot tell you

An ASN identifies a network, not a person or a device. It will not tell you which customer of a provider is behind an address, whether that customer is on a phone or a laptop, or anything about the browser. It also lags reality: a block sold last week may still be announced by the old network, and a new hosting company's ASN may be unclassified until the lists catch up. Read it as the strongest single fact about a connection, which it is, and combine it with the address-level reputation and the browser-side signals for the whole picture.