What Is an ASN and How to Find the ASN for an IP Address

When you trace a security incident, investigate a DDoS source, or debug a routing anomaly, you need to know which organization controls a given IP address — and that answer comes from the Autonomous System Number (ASN) that announced the prefix containing it.

What Is an Autonomous System?

The internet is not one network. It is tens of thousands of independently operated networks — carriers, cloud providers, enterprises, universities, CDN operators — each running its own internal routing policy and connected to others via BGP (Border Gateway Protocol). Each of these networks is an Autonomous System (AS).

An Autonomous System Number (ASN) is the unique identifier assigned to an AS by a Regional Internet Registry (RIR). The five RIRs are ARIN (North America), RIPE NCC (Europe/Middle East), APNIC (Asia-Pacific), LACNIC (Latin America), and AFRINIC (Africa). ASNs were historically 16-bit integers (1–65535), giving 65,535 possible values. When the public pool neared exhaustion, RFC 4893 extended ASNs to 32 bits (4-byte ASNs), supporting over 4 billion values. Private-use ASNs are 64512–65534 (16-bit) and 4200000000–4294967294 (32-bit) — you will see these inside MPLS VPNs and inside large enterprise networks.

How BGP Uses ASNs to Route the Internet

BGP is the protocol that ties autonomous systems together. Each AS advertises the IP prefixes it owns (or is authorized to announce) to its neighbors using BGP UPDATE messages. Those advertisements carry an AS_PATH attribute — a list of every ASN the announcement has transited. This serves two purposes: loop prevention (an AS discards a route that already contains its own ASN in the path) and policy (operators can prefer or avoid paths through specific ASes).

The ASN that first originated a prefix into BGP is the origin AS — the rightmost entry in the AS_PATH. When you look up which ASN "owns" an IP, you are really asking: which AS is the origin AS for the most-specific prefix covering that IP?

A single large organization may operate multiple ASNs — one per region, one per acquired company, or one per product line. Conversely, a hosting provider may announce address space on behalf of a customer using BGP communities or AS_PATH prepending, so the origin AS is the provider, not the end organization.

Three Ways to Find the ASN for an IP Address

1. Use a BGP Lookup Tool

The fastest method. The BGP View Lookup tool queries live routing table data and returns the covering prefix, origin ASN, AS name, and the RIR that issued the ASN — all in one step. It draws from RIPEstat, which aggregates routing data from hundreds of route collectors worldwide and provides a public API.

2. Use whois

The whois command queries RIR WHOIS databases directly. For an IP address, the RIR record will include an origin: field listing the ASN:

# Query the RIPE NCC WHOIS server for a specific IP whois -h whois.ripe.net 1.1.1.1 # The output will include a route object: # route:          1.1.1.0/24 # origin:         AS13335 # For North American IPs, query ARIN: whois -h whois.arin.net 8.8.8.8 # Team Cymru's IP-to-ASN mapping service (clean output): whois -h whois.cymru.com " -v 8.8.8.8"

The Team Cymru service is particularly useful in scripts because it returns a compact, parseable line: ASN, IP, BGP prefix, country code, RIR, and AS name.

3. Query a Looking Glass

A looking glass is a read-only BGP query interface operated by a carrier or IXP that lets you run show ip bgp commands against a real router in their network. This is the most authoritative view because you see the actual routing table, not a snapshot.

# On a Cisco IOS router (or via a looking glass web interface): show ip bgp 8.8.8.8 # Output excerpt: # BGP routing table entry for 8.8.8.0/24 # Paths: (2 available, best #1) #   15169 #     ... #     Origin IGP, metric 0, localpref 100, valid, external, best #     AS-path: 15169

Public looking glasses are operated by RIPE NCC (RIPE RIS), Hurricane Electric (lg.he.net), and most Tier-1 carriers. The RIPE NCC route collectors cover over 1,000 BGP sessions from 500+ peers globally.

Reading a BGP Prefix Record

When you look up an IP address and get a BGP prefix record back, here is what each field means:

Note that country codes in RIR records reflect the registrant's registration address, not necessarily the physical location of infrastructure. A CDN may register an ASN in the US while the actual servers serving that IP are in Frankfurt.

Why This Matters in Practice

Knowing the ASN for an IP address is useful in several common engineering scenarios:

• Security incident response: Identify the carrier or hosting provider responsible for an attacking IP so you can file an abuse report or implement a null route. ASN-level blocks are far more efficient than IP-by-IP blocking.
• BGP troubleshooting: If traffic to a prefix is taking a sub-optimal path, check the AS_PATH. Unexpected ASes in the path indicate route leaks, policy mismatches, or provider issues.
• Geofencing and access control: Some organizations implement coarse geographic access controls by allowing or denying entire ASNs (e.g., blocking residential ISP ASNs from accessing an API endpoint).
• Peering and transit decisions: Understanding which ASNs are responsible for the most traffic on your network informs peering negotiations and transit provider selection.

For working with IP address blocks at the subnet level, the Subnet Calculator lets you break down any prefix into its components. For BGP-level investigation, use the BGP View Lookup tool for immediate results backed by RIPEstat routing data.

RIPEstat as a Data Source

RIPEstat is a public data platform operated by RIPE NCC that aggregates routing data, WHOIS records, and historical BGP visibility into a single API. It is the backbone behind many IP intelligence tools, including the BGP View Lookup tool on this site. Key data points available via RIPEstat include:

• Current BGP visibility and the covering prefix for any IP
• Historical BGP data — when a prefix was first seen, route changes over time
• ASN neighbor relationships (what ASes peer with the origin AS)
• RIR allocation records and RPKI (Resource Public Key Infrastructure) validity

RPKI is increasingly relevant: it cryptographically validates that a given AS is authorized to announce a specific prefix, helping detect and prevent BGP hijacks. When you look up a prefix and see RPKI status "valid," the route origin has been cryptographically verified against a signed ROA (Route Origin Authorization).

Whether you are investigating a security event, debugging a routing anomaly, or simply curious who operates a particular IP block, the BGP View Lookup tool gives you the ASN, prefix, and organization in seconds. For related routing filter work, see the prefix lists vs. ACLs guide.