ASN Lookup Explained: How to Find the Network Behind an IP

The internet is a network of networks, and each independently operated network is an autonomous system. RFC 1930 defines an AS as a connected group of IP prefixes run by one or more operators under a single, clearly defined routing policy. An Autonomous System Number, the ASN, is the identifier that network uses when it exchanges routes with its neighbors. Large ISPs, mobile carriers, cloud providers, universities, content networks and many enterprises each operate one or more.

IANA allocates blocks of AS numbers to the five regional internet registries, which assign them to operators, and IANA's AS numbers registry records the allocations. Numbers were originally 16-bit, giving 65,536 values; RFC 6793 extended BGP to carry 32-bit numbers, so an ASN today can be as large as 4,294,967,295. The size of the number says nothing about the network; it only reflects when the number was assigned.

Networks announce the prefixes they are responsible for to their neighbors using the Border Gateway Protocol, defined in RFC 4271, and each announcement carries the path of AS numbers it traveled through. When a lookup tool says an address 'belongs to AS15169', it means that AS15169 is currently announcing the prefix containing that address to the global routing system. The origin AS is a fact about routing right now, gathered from route collectors such as RIPE's Routing Information Service and the University of Oregon's Route Views project, not a fact about who is registered as the address holder.

The two usually coincide and sometimes do not. An operator can announce space it leases from another registrant, a company can have its addresses announced by a transit provider, and a hijacked prefix is announced by an AS that has no right to it. Registration data answers 'who holds this range'; the origin AS answers 'whose network is carrying it'. The WHOIS and RDAP guide covers the registration side.

RDAP, the registration data protocol that replaced WHOIS, has a query type for autonomous system numbers: RFC 9082 defines the path segment autnum, so a request for /autnum/15169 returns the registration record for AS15169. Finding the right registry uses the bootstrap procedure in RFC 9224: IANA publishes asn.json, a file listing which ranges of AS numbers each RIR serves, and a client picks the base URL that covers the number.

For 15169 that is ARIN, and a request to rdap.arin.net/registry/autnum/15169 returns a record with the handle AS15169, the name GOOGLE, a start and end number of 15169 (a single-number block), the registrant entity and a technical contact, plus registration and last-changed dates. Larger operators hold ranges of consecutive numbers, and the record for any one of them shows the whole range. An ASN lookup tool performs the same steps and adds the prefixes currently announced by that AS.

The ISP is the company a customer pays; the ASN is a routing identifier. They are often the same organization, but one company may run several autonomous systems, for its consumer broadband, its mobile network and its hosting arm, and a small ISP may have no AS of its own and use its upstream's number. A lookup that reports an ASN name and an ISP name is therefore reporting two different things, and when they differ it is usually a wholesale, reseller or leasing relationship rather than an error. The ISP lookup guide covers the consumer-facing side of the question.

The most useful thing an ASN tells you is the kind of network an address lives in. Operators are known: this AS is a cable provider, that one a mobile carrier, that one a cloud platform. Lookup providers label the AS and apply the label to its prefixes, which is how a result comes to say 'hosting' or 'residential' before anything about the individual address is known. The data center versus residential guide covers what the labels do and do not mean.

Two addresses in the same city can carry very different expectations. One announced by a residential ISP is most likely a household; one announced by a hosting AS is most likely a server, a VPN exit or an automated client. Neither expectation is a conclusion about the visitor.

Security. Rate limits and WAF rules can be scoped to an AS when abuse comes from one hosting network, and login alerts can weigh a change of AS more heavily than a change of city, since a real user changing ISP is rarer than a real user changing town.

Fraud review. Network type from the AS, combined with velocity, account history and a fraud score, separates a customer on a home connection from automation on a cloud server far better than location alone. The AS is one input to that picture.

Networking. Operators use ASNs to set peering and transit policy, to filter routes, and to trace where a path goes wrong; the AS path on a route is the map of who carried it.

Troubleshooting and support. When a customer reports being blocked or seeing the wrong location, the AS says which network they are on, which often explains both: a mobile carrier AS accounts for a city mismatch, a corporate AS for an unexpected country, a hosting AS for a VPN. The abuse contact guide covers reaching the operator when the traffic needs reporting.

An ASN describes a network, not a person or a device. A large residential AS contains millions of subscribers, so an AS-level rule affects all of them; a hosting AS contains legitimate integrations alongside abusive ones. The label attached to an AS is an inference by the lookup provider and can lag when a network changes its business or leases space. The origin AS can be wrong during a hijack or a misconfiguration. And a change of AS between two sessions is a signal that the network changed, which happens whenever a phone leaves Wi-Fi, a laptop joins a VPN or a company reroutes its egress.

Use ASN data as one layer of evidence about the network behind an address. Pair it with reverse DNS, request behavior, velocity and account history before making a decision, and keep the decision reversible.