What is an ASN?
An autonomous system is a network under one routing policy, run by one or more operators, and its number (ASN) identifies it in internet routing. Each network announces its addresses to its neighbours under that number, and routers learn the way to any address from the sum of these announcements. Knowing which network an address belongs to tells you what kind it is: a home provider, a mobile operator or a data centre.
The formal definition
RFC 1930 defines an autonomous system as a connected group of IP prefixes run by one or more operators. What defines it is a single, clearly defined routing policy. The key word is policy, not the number of networks or the size of the company.
The RFC says a network needs its own number when it connects to more than one provider, each with its own policy. A network connected to a single provider normally stays inside that provider's system and needs no number of its own.
How autonomous systems talk: BGP
Autonomous systems exchange routes with the Border Gateway Protocol (BGP), defined in RFC 4271. A session runs between two neighbouring routers on TCP port 179, and the process goes like this:
- The network that holds a prefix, the origin system, announces that those addresses are reachable through it.
- Each system that passes the announcement on adds its own number to the AS_PATH attribute before sending it to its neighbours.
- A router that receives an announcement already carrying its own system's number ignores it, so routes cannot loop.
- A router that hears several routes to the same prefix picks one by its network's policy, such as a preferred neighbour or the shortest path.
- Packets follow the chosen route, system by system, until they reach the origin.
This is what a route to a prefix looks like in a routing table, using numbers reserved for documentation:
prefix AS_PATH
203.0.113.0/24 64496 64500 64511The first number is the neighbour the announcement came from, and the last, 64511, is the origin system that holds or announces the addresses. When you look up the ASN of an address, the origin is what you are looking for.
Number ranges
AS numbers were originally 16 bits, from 0 to 65535. RFC 6793 extended them to four octets, raising the range to 4294967295. It also reserved 23456 as AS_TRANS, which stands in for long numbers when talking to older routers that only understand two octets.
The IANA autonomous system number registry lists the ranges that never appear on the public internet:
| Range | Use |
|---|---|
| 64496-64511 and 65536-65551 | Documentation and examples |
| 64512-65534 | Private use inside networks (16-bit) |
| 4200000000-4294967294 | Private use inside networks (32-bit) |
| 0, 65535 and 4294967295 | Reserved, not used |
IANA gives blocks of numbers to the five regional registries: AFRINIC, APNIC, ARIN, LACNIC and the RIPE NCC. The registry assigns a number to an operator and publishes the system's name and the responsible organisation in its database.
How systems relate to each other
Not every system connects to every other. A small network buys transit from a larger provider, which carries it to the rest of the internet for a fee. Two networks of similar size often exchange their customers' traffic directly without payment, which is called peering.
Much of this exchange happens at internet exchange points, where many networks connect in one building. Each system's policy for accepting and announcing routes follows these business relationships, not the shortest geographic distance.
An operator gets its number from the regional registry for its area. Registries usually require a routing policy of the network's own, such as connecting to more than one provider. This is the same principle as in the definition above.
Who may announce a prefix
BGP was built on trust between neighbours, and nothing in the protocol itself stops a network from announcing addresses it does not hold. This can happen by misconfiguration or on purpose, drawing the traffic for those addresses to the wrong network. This is called a route hijack.
The most widely deployed protection today is the Resource Public Key Infrastructure (RPKI). The address holder publishes a signed Route Origin Authorisation (ROA) naming the system allowed to announce its prefix, and the prefix's maximum length. Routers that validate these authorisations reject announcements that break them.
So knowing which system announces an address today is not the whole story. Routing monitors keep a history of announcements, and any sudden change of origin shows up there.
What an ASN reveals about an address
An address says nothing about its owner on its own. The system that announces it ties it to a known organisation, and from that the type of network follows:
- Home provider or mobile operator. Its addresses are used by people at home and on their phones.
- Hosting or cloud. Its addresses are used by servers, and people rarely browse from them directly.
- Company, university or government network. Office and institutional addresses with their own system.
That is why anti-fraud systems use the ASN as a first signal: a connection from a hosting network is often treated as automated or relayed. How sites combine these signals is covered in How websites detect VPNs and proxies. The types of address are compared in Residential, mobile and datacenter proxies.
The number is a coarse signal, though. One operator can announce fixed, mobile and data-centre addresses from the same ASN. A company can also lease addresses from a system that does not carry its name.
How to find the ASN of any address
The What is my IP tool shows the network number and name for your current address. For any other address you can query the registries directly, for example through the RIPEstat API:
curl -s "https://stat.ripe.net/data/network-info/data.json?resource=193.0.6.139"The data field in the reply holds the prefix 193.0.0.0/21 and the system number 3333, which belongs to the RIPE NCC itself. To see who holds a system, query the whois record for the number:
whois -h whois.ripe.net AS3333What this means when choosing a proxy or VPN
- Check the network before relying on a service. If a service only opens from a certain country or type of network, the exit address's ASN tells you what it will see.
- The number is public and cannot be hidden. Any site can look it up in seconds. Only leaving from an address on another network changes it.
- The registry name may differ from the brand. The record carries the legal entity that registered the number, which may be a parent company or an infrastructure operator.
syriaproxy addresses
The addresses your traffic leaves from with syriaproxy come from Syriatel's 4G network inside Syria, a mobile operator's system rather than a hosting network. You can see the network number and name yourself while connected, using the address tool mentioned above.
FAQ
Does an ASN reveal my location?
It reveals the organisation behind the network and the country where it is registered, not where you are. Location is estimated by other means, described in IP geolocation.
Does every person or company need an ASN?
No. You need one if you connect to more than one provider and want to announce your own addresses. Most companies and individuals use their provider's addresses within its system.
Can one prefix belong to more than one system?
Normally one system announces a prefix. Some special arrangements announce it from several, and it can also happen by mistake or through route hijacking, which routing monitors pick up.
Why does the network name differ from one tool to another?
Some tools show the system's name from its registry record, others a commercial provider name from their own database. The number is the stable reference.
Look up any IP or domain to see its network number, name and type.