Looked up a moment ago
AS numbers other visitors opened just now. Click one for its prefixes, peers and upstreams.
What an ASN lookup tells you, and what it can't
The ASN identifies a network, not the customers on it.
Every result page shows
- Operator name, the organisation that runs the AS
- Country of registration and the regional registry (RIR)
- Date the ASN was allocated
- Type of network: transit, content, hosting, enterprise, IXP, government, education
- Every IPv4 and IPv6 prefix announced in BGP, with size
- BGP peers, the ASNs it exchanges routes with
- Upstream transit providers, the ones it pays for full connectivity
- RPKI signing state of the announced prefixes
- Abuse and technical contact from the RIR
No lookup will return
- Names or addresses of individual subscribers
- Traffic volume or bandwidth for one IP inside the AS
- The customer cone (which downstream ASNs depend on it for transit) without paid intelligence services
- Real-time route hijack alerts (BGPMon or Cloudflare Radar do that)
An ASN is a wholesale identifier. "Which user sits behind this AS" needs the operator's cooperation and a court order.
How complete each field is
Measured across the live BGP table from public route collectors (RIPE RIS, RouteViews) plus the five RIRs (ARIN, RIPE, APNIC, LACNIC, AFRINIC), 240+ countries. Numbers refresh continuously.
| Field | Coverage | Source |
|---|---|---|
| Operator name | 100% | RIR registration |
| Country / RIR | 99% | ISO 3166 plus registry |
| Prefixes | 100% | IPv4 and IPv6 in BGP |
| Peers | 96% | BGP adjacencies |
| Upstreams | 88% | Transit providers |
| RPKI valid | 72% | Signed ROAs |
The global routing table right now
Live numbers across the table every result is built from.
How to look up an ASN
With or without the AS prefix, in any case.
Paste the number into the box above. AS15169 and 15169 both open the same Google record, and 32-bit numbers work the same way (AS3320001 or 3320001). ASNs are written without a space (AS3356, not AS 3356) and in capitals by convention, but the lookup accepts any case. The result page lists the operator, the country, every prefix, and links every related ASN and IP so you can keep drilling.
Only have an IP? Run it through the IP lookup: the result names the announcing AS and links straight into this page for the prefix list.
BGP, peering, transit and RPKI in plain words
What the peers, upstreams and RPKI columns on a result page actually mean.
When two networks want to exchange traffic they need a way to say "I own these IP ranges, send my traffic this way". That conversation runs over BGP (Border Gateway Protocol), first defined in RFC 1163 (1989), today RFC 4271 (2006). Every AS in BGP runs at least one router that announces its prefixes to neighbours and listens for theirs. All those announcements together are the global routing table, about 980,000 IPv4 entries today.
Two ASes relate to each other in one of three ways:
- Transit: the customer pays the provider for reachability to the whole internet. Tier-1 carriers (Lumen, NTT, Telia, Cogent, Telstra, Tata, GTT) sell transit to everyone smaller.
- Peering: two networks exchange traffic between their own customers for free. Cheaper and faster, but it only covers each other's prefixes.
- IXP membership: many networks plug into one shared switch at an Internet Exchange Point (DE-CIX Frankfurt, AMS-IX Amsterdam, LINX London) and peer in bulk over it.
Our result page parses peers and upstreams from public route collector data. Big content networks (Google, Cloudflare, Akamai, Meta, Amazon) peer aggressively to keep traffic off paid transit. A small ISP usually pays one or two upstreams and peers at one IXP.
Hijacks, and what RPKI does about them
BGP was designed to trust whatever a neighbour announces, which was fine for a handful of research networks and is not fine now that any AS can announce someone else's prefix and pull in their traffic. BGP hijacks happen routinely: Pakistan taking down YouTube (2008), Rostelecom hijacking Mastercard (2017), Hetzner accidentally hijacking parts of Amazon (2022). The damage ranges from minutes of outage to credential theft when the attacker can intercept TLS handshakes.
The fix is RPKI (Resource Public Key Infrastructure). Operators publish ROAs (Route Origin Authorizations), signed by their RIR, that say "AS X may announce prefix Y". Networks running Route Origin Validation drop announcements that fail. About 42% of routes now have valid ROAs, and Cloudflare, Google, Amazon and Telia drop invalid routes at the edge. The result page shows the RPKI state of each prefix.
When an ASN lookup is actually useful
The jobs it does every day.
Abuse investigation
An IP is hammering your service. The IP lookup gives you geo and ISP; the ASN tells you whether it is a big residential ISP (report to the listed abuse contact, expect action), a hosting provider (expect a customer suspension) or a bulletproof host (skip the email, block the whole AS).
Network planning
Buying transit, choosing an IXP, picking a CDN POP: you want to know which networks are well peered in your city. The peer list on each ASN page is the free version of analytics that cost real money elsewhere.
BGP troubleshooting
A traceroute dies at one hop. Look up that hop's ASN, find the NOC or abuse contact, send them the trace. Cross-network problems are mostly about finding the right human, and the ASN record is the directory.
Hijack monitoring
Compare today's announced prefixes for your own AS with yesterday's. A prefix of yours suddenly also announced by an AS you don't know is a hijack in progress. BGPMon and Cloudflare Radar alert in real time; this lookup is the free manual fallback.
Threat intel and policy
Some ASNs concentrate abuse: ransomware C2, brute force, scanning, residential proxy pools. Security teams keep block lists at the AS level, and content rules like "do not serve to networks owned by company X" are simpler than maintaining IP lists. The network type (hosting, residential, mobile) is a useful pre-classifier.
Geolocation troubleshooting
By default an IP geolocates to the country its AS is registered in. If your customer in Berlin gets the Bangkok version of your site, compare the AS country with the IP lookup's country; when they disagree, the AS-level data is usually the truth.
More about ASNs and how the internet routes
The questions people ask after their first lookup. Skim what is interesting, skip the rest.
What is an Autonomous System
A network, or a set of networks, under one administration with one routing policy. ISPs, hosting providers, large enterprises, universities and content companies each run one or more, and each gets a unique ASN from its regional registry. Networks too small for their own ASN connect through a larger provider's AS and pay for transit.
16-bit vs 32-bit ASNs
The original format was 16-bit: 65,536 values (0 to 65,535), of which 64,512 to 65,534 are reserved for private use. The public pool ran low by 2007, so IANA introduced 32-bit ASNs (RFC 4893), which start at 65,536 and run past 4 billion. They are sometimes called "4-byte" or "asplain", every modern BGP router supports them, and the lookup accepts AS15169, AS3320001 and dot notation like AS65536.0.
Five RIRs and how ASNs get allocated
IANA delegates ASN blocks to ARIN (North America, Caribbean, parts of the Atlantic), RIPE NCC (Europe, Middle East, central Asia), APNIC (Asia-Pacific), LACNIC (Latin America and Caribbean) and AFRINIC (Africa). To get one you normally need a multihomed network (at least two upstreams) and a minimum size, and it costs from a few hundred euros a year (RIPE) to a few thousand dollars (ARIN).
The AS_PATH and how routes are chosen
When AS1 announces a prefix to AS2, the announcement carries AS1's number in the AS_PATH. AS2 prepends its own number when it passes the route on, so after ten networks the path reads AS10 AS9 AS8 ... AS1. Routers prefer shorter paths by default, so traffic follows the most direct chain of networks. A traceroute is roughly the inverse: each hop's IP belongs to one AS, and reading it top to bottom shows which networks the packet crosses.
Tier 1, Tier 2, Tier 3
Informal but useful. Tier 1 networks reach the whole internet through peering alone and pay nobody: perhaps a dozen, including AS174 (Cogent), AS2914 (NTT), AS3356 (Lumen, ex Level 3), AS1299 (Arelion, ex Telia Carrier), AS6453 (Tata), AS6762 (Sparkle) and AS6939 (Hurricane Electric, often called Tier 1.5 because some peers refuse to settle-free with them). Tier 2 pays some transit but peers heavily. Tier 3 pays for everything. Big CDNs (Cloudflare AS13335, Google AS15169, Akamai AS20940, Meta AS32934, Amazon AS16509) are not Tier 1 in the classic sense; they are content networks that peer everywhere.
ASNs worth recognising
- AS15169 Google, the biggest content network, about 12% of all internet traffic
- AS13335 Cloudflare, CDN and DDoS protection in front of millions of sites
- AS16509 Amazon AWS
- AS32934 Meta: Facebook, Instagram, WhatsApp
- AS3356 Lumen (Level 3 legacy), one of the oldest Tier 1s
- AS174 Cogent, Tier 1, famous for the 2008 IPv6 peering war with Hurricane Electric
- AS1299 Arelion (formerly Telia Carrier), European Tier 1 backbone
- AS2914 NTT Global, Japanese Tier 1 with strong APAC reach
- AS6939 Hurricane Electric, largest IPv6 network by peering count
- AS7018 AT&T, big US incumbent
- AS3320 Deutsche Telekom, largest European telco
- AS24940 Hetzner, German bare-metal and cloud host
- AS14061 DigitalOcean, developer cloud host
Private and reserved ASNs
Two ranges never appear in the public table, much like private IP ranges: 64,512 to 65,534 (16-bit) and 4,200,000,000 to 4,294,967,294 (32-bit). Enterprises use them for internal BGP. AS0 means "no AS" and turns up in route filtering; AS23456 (AS_TRANS) was the placeholder for 32-bit numbers back when not every router understood them.
IRR, route objects and route collectors
Networks declare which prefixes they intend to announce as route objects in IRR (Internet Routing Registry) databases; upstreams build their prefix filters from them, and an announcement without a matching object is dropped at the customer's edge. IRR is trust-based, RPKI is signed, and most networks use both. The routing table itself has no single source of truth: RIPE RIS and RouteViews collect BGP feeds from hundreds of networks and publish the merged view, looking glasses such as bgp.he.net let you query one router interactively, and our result page combines collector data with the RIR record.
Table growth and the customer cone
The table grows about 5% a year, to roughly 980,000 IPv4 and 195,000 IPv6 routes today, driven by prefix disaggregation for traffic engineering and by new IPv6 deployments. Older routers hit memory limits and have to be replaced; default-free zone carriers hold the full table, edge ISPs often take a partial feed. A network's customer cone is itself plus every AS that depends on it for transit, recursively. CAIDA's AS Rank is built from cone size: Lumen, NTT and Telia score high because thousands of networks pay them, while Cloudflare's cone is close to zero (it sells services, not transit) despite a huge peering footprint.