What Is an ASN? A Guide for Developers
An ASN, or Autonomous System Number, is a unique number that identifies a network operated by a single organization and announcing its own routes on the internet, such as an ISP, a cloud provider, a university or a large company. When you look up an IP address, the ASN is the field that tells you which network the address belongs to and who runs it.
What an autonomous system is
The internet is not one network but a collection of independently operated ones. Each of those networks, called an autonomous system, controls its own address space and its own routing policy. To exchange reachability information, autonomous systems talk to their neighbours using the Border Gateway Protocol (BGP). Each system announces the IP prefixes it can deliver traffic to, and each announcement carries the ASN of the network that originates it.
Google's networks have ASNs, so do residential ISPs, mobile carriers, content delivery networks and hosting companies. AS15169, for example, is registered to Google. A single company may operate several autonomous systems, and a small organization with a single upstream often has none, using its provider's number instead. ASNs were originally 16-bit numbers, and the space was extended to 32 bits, which is why you see both small and very large ASN values.
Who assigns ASNs
ASNs are allocated hierarchically. IANA hands blocks of numbers to the five regional internet registries, and the registries assign them to organizations in their regions:
- AFRINIC covers Africa.
- APNIC covers Asia and the Pacific.
- ARIN covers the United States, Canada and parts of the Caribbean.
- LACNIC covers Latin America and parts of the Caribbean.
- RIPE NCC covers Europe, the Middle East and parts of Central Asia.
An organization applies to its registry, usually as a member or through a sponsoring provider, and typically needs to justify the request, for example by operating or planning to operate a multi-homed network. Requirements and fees differ between registries, so check the current policy of the registry you would apply to. Some ranges are reserved for private use and documentation and never appear on the public internet.
Why developers should care
An IP address on its own is just a number. The ASN gives it an owner, and that opens up several practical uses. You can tell hosting and cloud networks from consumer ISPs, which matters for bot detection and for interpreting traffic. You can tune allow and block lists by network instead of by single addresses, and you can group abusive behaviour by origin instead of chasing one address at a time. During an incident, finding that dozens of sources share one ASN turns a scattered log into a pattern.
The ASN lookup on ipto takes an AS number such as AS15169 and returns the registered owner, organization name, country and the number of IP ranges attributed to it, with a dedicated page for each ASN listing its announced ranges. It is answered from ipto's own routing and registry dataset, refreshed daily. In the main IP lookup, the asn and org fields give you the same information for a given address, along with flags such as is_vpn, is_datacenter and is_abuser.
ASNs, security and their limits
The ASN is a useful input to reputation, since networks vary in how well they police their customers. That is why VPN detection combines blocklists with ASN data, and why abusive network rankings and the IP abuse checker show which network an address sits in. A bad host is more actionable when you can see the whole range around it, which the IP range directory lets you browse by /8 and /16 block.
It also helps to know what an ASN does not tell you:
- It describes who operates a network, not who is using one address inside it. A cloud ASN covers thousands of unrelated customers.
- The country is the registration country, which is not always where the infrastructure physically sits.
- Registry records can lag behind acquisitions and reorganizations.
- BGP itself is built on trust. A network can announce prefixes it does not own, which is called a route hijack, and RPKI route origin validation exists to help detect this. The RPKI lookup checks whether the route currently announced for an IP is covered by a valid ROA, which reports valid, invalid or not covered.
To follow up on ownership, IP whois via RDAP returns the structured registry record for a block. The free tier allows 1,000 requests per day with no signup, and the API documentation lists the endpoints. For a related concept, see what a CIDR block is, since each ASN announces its address space as CIDR prefixes.