What is an ASN? Autonomous system numbers explained

0216-bit and 32-bit ASNs, and the reserved ranges

ASNs were originally 16-bit numbers, 65,536 values in total. RFC 6793 extended BGP to 4-byte numbers, about 4.29 billion values. Routers that only understand 2-byte numbers see the placeholder AS 23456 (AS_TRANS) wherever a 4-byte ASN appears, which is why that number turns up in old equipment's output.

RFC 5396 recommends writing ASNs as plain decimal numbers (asplain). Older tools use asdot, which writes values from 65,536 upwards as two 16-bit halves: AS 65546 becomes 1.10.

03Who assigns ASNs?

IANA allocates blocks of ASNs to the five regional internet registries, AFRINIC, APNIC, ARIN, LACNIC and the RIPE NCC, which assign individual numbers to networks in their regions, directly or through sponsoring members. RFC 1930 explains the logic: a network needs its own ASN when it has its own routing policy, typically because it connects to more than one upstream provider.

A customer that only ever talks to one provider usually needs no public ASN. It can use a private one on its BGP session, or let the provider announce its addresses.

04How to look up the ASN of an IP address

Use a source built from live routing data for "which network announces this address now", and the registry for "who holds it and whom do I contact". The table compares the sources. The commands after it are read-only queries to public services, using the RIPE NCC's own address, 193.0.6.139, with real output shortened. For a quick answer in the browser, the IP & ASN lookup shows the ASN, organisation and prefix for any address.

# Team Cymru's IP-to-ASN service, built from BGP data
whois -h whois.cymru.com " -v 193.0.6.139"
# AS   | IP          | BGP Prefix   | CC | Registry | Allocated  | AS Name
# 3333 | 193.0.6.139 | 193.0.0.0/21 | NL | ripencc  | 1993-09-01 | RIPE-NCC-AS ...

# the same over DNS: reverse the octets
dig +short TXT 139.6.0.193.origin.asn.cymru.com
# "3333 | 193.0.0.0/21 | NL | ripencc | 1993-09-01"

# RIPEstat: announcing ASN and prefix as JSON
curl -s 'https://stat.ripe.net/data/network-info/data.json?resource=193.0.6.139'

# registry route object: the ASN the holder says should originate it
whois -h whois.ripe.net -- '-T route 193.0.6.139'

# every route object registered for an ASN in RADb
whois -h whois.radb.net -- '-i origin AS3333'

05What an ASN lookup tells you, and what it does not

A lookup returns the origin ASN, the covering prefix, the registry, the allocation date and a name. Read each with care.

• The country code is where the block or ASN is registered, not where the device is
• The AS name is the holder's label, often abbreviated or out of date after mergers
• Two origin ASNs for one prefix can be a deliberate set-up, but it is also what a hijack looks like; see BGP hijacking
• A more specific prefix than usual from an unfamiliar ASN deserves a second look
• Where routing data and registry disagree, the routing data shows where packets actually go

06Why ASNs matter for DDoS mitigation and abuse reports

Grouping traffic by origin ASN turns thousands of addresses into a handful of networks, which is how operators make sense of an attack. A flood that comes mostly from hosting and cloud ASNs looks very different from one spread across residential broadband networks, which points towards a botnet of compromised home devices.

Two cautions apply. In reflection and amplification attacks the packets really do come from the reflectors' networks, but those servers are victims too, misused through spoofed requests. And blocking an entire ASN is blunt: hosting networks carry legitimate API clients, monitoring and crawlers alongside abuse, so ASN works best as one signal among several, as in bot management.

For abuse reports, the registry record names the contact. RIPE NCC records carry an abuse-mailbox attribute, which RIPEstat also exposes through its API:

whois -h whois.ripe.net -- '-b 193.0.6.139'
# inetnum:        193.0.0.0 - 193.0.7.255
# abuse-mailbox:  [email protected]

curl -s 'https://stat.ripe.net/data/abuse-contact-finder/data.json?resource=193.0.6.139'

# what kind of network an ASN is, from PeeringDB
curl -s 'https://www.peeringdb.com/api/net?asn=3333'

07Do you need your own ASN?

You need one to announce address space under your own routing policy to more than one network, which covers multihoming across two transit providers and many bring-your-own-IP arrangements. You also need to know your ASN, or your provider's, to publish correct ROAs, because a ROA names the ASN allowed to originate a prefix; see what RPKI is.

For routed DDoS protection of your own prefix there are two common set-ups. Either the provider originates your prefix from its ASN during mitigation, which needs a ROA naming the provider's ASN, or your ASN stays the origin and the provider acts as transit. RFC 9319 describes both and warns that the ROA must exist before the attack, because RPKI changes propagate more slowly than BGP. Clean traffic then reaches you through a tunnel, compared in GRE vs IPIP.