What is an ASN (Autonomous System Number)? BGP Explained

An ASN (Autonomous System Number) is a unique number that identifies a network with its own routing policy on the Internet. BGP carries it with every route: the origin ASN shows which network announced a prefix, and the AS_PATH lists every network the route crossed. Public ASNs are assigned by the five Regional Internet Registries, and since 1 January 2010 the RIPE NCC has assigned them from a single 32-bit pool (ripe-679).

What is an Autonomous System Number (ASN)?

An Autonomous System Number (ASN) is a globally unique identifier assigned to an autonomous system for use in BGP routing.

Defining an Autonomous System

An autonomous system (AS) is a collection of IP networks and routers under the control of a single organization that presents a common routing policy to the Internet. As defined in RFC 1930, an AS is:

"A connected group of one or more IP prefixes run by one or more network operators which has a SINGLE and CLEARLY DEFINED routing policy."

An autonomous system represents a network or group of networks managed by a single administrative entity (such as an ISP, large enterprise, or hosting provider) that makes its own decisions about how to route traffic.

The Role of ASNs

ASNs serve as unique identifiers for these autonomous systems, similar to how phone numbers identify telephone lines or IP addresses identify devices on a network. When routers exchange routing information using BGP, they use ASNs to:

Identify the origin of routing announcements
Track routing paths across the Internet
Implement routing policies based on AS relationships
Prevent routing loops by detecting when a route passes through the same AS multiple times
Enable traffic engineering and policy-based routing decisions

ASN Format and Numbering

ASNs come in two formats, defined in RFC 4271 and RFC 6793:

16-bit ASNs (Original Format):

Range: 0 to 65,535 (65,536 numbers)
Public range: 1 to 64,495
Documentation: 64,496 to 64,511 (RFC 5398)
Private range: 64,512 to 65,534 (RFC 6996)
Reserved: 0 and 65,535; 23456 is AS_TRANS, the number a 32-bit speaker sends to a peer that only understands 16-bit numbers (RFC 6793)

32-bit ASNs (Extended Format):

Range: 0 to 4,294,967,295 (over 4.2 billion numbers)
Public range: 131,072 to 4,199,999,999 (65,536 to 65,551 are documentation numbers, 65,552 to 131,071 are reserved)
Private range: 4,200,000,000 to 4,294,967,294
Reserved: 4,294,967,295

The expansion to 32-bit ASNs was needed because the 16-bit space ran out. Since 1 January 2010 the RIPE NCC has assigned ASNs from one undifferentiated 32-bit pool (ripe-679), so applicants cannot ask for a 16-bit number. In practice every recent assignment is 32-bit: the RIPE NCC issued 17 16-bit ASNs in 2024, 3 in 2025 and none in 2026 up to 24 September, against 2,175 32-bit ASNs in 2026 (RIPE NCC delegated statistics, file of 24 September 2026).

The IANA AS Numbers Registry shows the blocks handed to each RIR.

ASN Notation:

16-bit ASNs: Written as a single number (e.g., AS64500)
32-bit ASNs: Can be written in "asplain" format (e.g., AS4200000000) or "asdot" format (e.g., AS1.0)

Public vs Private ASNs

Similar to IP address space, ASNs are divided into public and private ranges:

Public ASNs:

Globally unique numbers assigned by RIRs
Required for routing on the public Internet
Registered in the RIR database (an aut-num object in the RIPE Database)
Must be obtained through official RIR processes

Private ASNs:

Reserved for internal use only
Never announced on the public Internet
Can be used for internal BGP configurations, testing, or private peering
16-bit private range: 64,512 to 65,534
32-bit private range: 4,200,000,000 to 4,294,967,294

Private ASNs are useful for:

Testing BGP configurations in lab environments
Internal iBGP routing within organizations
MPLS VPN implementations
Any scenario where routes never reach the global Internet

Private ASN ranges vs your own public ASN covers when a private number is enough.

How BGP Routing Works

BGP: The Internet's Routing Protocol

BGP is the standardized exterior gateway protocol used to exchange routing information between autonomous systems. Unlike interior gateway protocols (IGPs) like OSPF or EIGRP that operate within a single AS, BGP operates between autonomous systems, making routing decisions based on paths, network policies, and rule sets configured by network administrators.

BGP is defined in RFC 4271, with numerous extensions and updates in subsequent RFCs.

Key characteristics of BGP:

Path-vector protocol: BGP maintains the entire path (sequence of ASNs) that routes traverse
Policy-based routing: Administrators can implement complex routing policies based on business relationships
Slow convergence: BGP prioritizes stability over rapid convergence
TCP-based: Uses TCP port 179 for reliable communication between BGP peers
Incremental updates: After initial exchange, only sends updates when routing changes occur

BGP Peering Relationships

BGP routers establish peering relationships (also called BGP sessions or neighbor relationships) with other BGP routers. There are two types of BGP peering:

1. eBGP (External BGP):

Peering between routers in different autonomous systems
Used to exchange routes between ASes
Typically has TTL=1 (directly connected routers)
Cisco IOS gives eBGP routes an administrative distance of 20, so they win over routes learned from OSPF or EIGRP

2. iBGP (Internal BGP):

Peering between routers within the same autonomous system
Used to distribute externally learned routes throughout the AS
Can peer with non-directly connected routers
Requires full mesh topology or route reflectors for proper operation
Cisco IOS gives iBGP routes an administrative distance of 200, so an IGP route to the same prefix wins

How BGP Uses ASNs

ASNs play a central role in BGP routing:

1. Route Origin Identification: When a network announces its IP prefixes via BGP, the announcement includes the origin ASN. This tells other networks which AS owns or is authorized to announce those prefixes.

Example:

Network: 203.0.113.0/24
Origin AS: AS64500

2. AS Path Attribute: As a BGP route advertisement propagates across the Internet, each AS it passes through prepends its ASN to the AS_PATH attribute. This creates a list of ASNs showing the path the route has taken.

Example path:

AS_PATH seen at AS64503: 64502 64501 64500 (64500 is the origin)

The AS_PATH serves multiple purposes:

Loop prevention: If a router sees its own ASN in the path, it rejects the route
Path selection: Shorter AS paths are typically preferred
Traffic engineering: ASes can artificially lengthen paths using AS path prepending

3. BGP Decision Process: When BGP routers receive multiple paths to the same destination, they use a decision process to select the best path. While the complete process involves many factors, ASN-related attributes play key roles:

Highest Weight (Cisco-specific, local to router)
Highest Local Preference (within AS)
Locally originated routes
Shortest AS_PATH length (the step that uses ASNs)
Lowest origin type
Lowest MED (Multi-Exit Discriminator)
eBGP over iBGP
Lowest IGP metric to BGP next hop
Oldest route
Lowest neighbor router ID

4. Routing Policies Based on ASNs: Network operators implement routing policies using ASNs to control traffic flow:

AS-based filtering:

# Only accept routes from specific ASes
ip as-path access-list 10 permit ^64500$
ip as-path access-list 10 permit ^64501$

AS path prepending for traffic engineering:

# Make path less attractive by prepending own ASN multiple times
route-map PREPEND permit 10
 set as-path prepend 64500 64500 64500

BGP Route Advertisement Process

Step 1: BGP Session Establishment Two BGP routers establish a TCP connection on port 179 and exchange OPEN messages containing their ASN, BGP version, and other parameters.

Step 2: Initial Route Exchange After session establishment, routers exchange their entire BGP routing table using UPDATE messages. Each route includes:

Network prefix (e.g., 203.0.113.0/24)
AS_PATH (sequence of ASNs the route has traversed)
NEXT_HOP (IP address of next router)
Various other BGP attributes (LOCAL_PREF, MED, COMMUNITY, etc.)

Step 3: Route Selection Each router runs the BGP decision process to select the best path to each destination, considering AS_PATH length and other factors.

Step 4: Route Installation Selected routes are installed in the router's routing table and forwarded to the router's forwarding table for packet forwarding.

Step 5: Incremental Updates After initial exchange, routers send UPDATE messages only when routing changes occur (new routes, withdrawn routes, or attribute changes).

Step 6: Keepalive Messages Routers exchange KEEPALIVE messages periodically (every 60 seconds by default on Cisco IOS; RFC 4271 suggests one third of the hold time) to maintain the BGP session.

Example: Route Advertisement Across Multiple ASes

Scenario: AS64500 (an ISP) announces its customer network 203.0.113.0/24

At AS64500 (Origin):

Network: 203.0.113.0/24
AS_PATH: 64500
Origin: IGP
Next_Hop: 192.0.2.1

At AS64501 (Transit Provider 1): Receives announcement from AS64500, prepends its own ASN:

Network: 203.0.113.0/24
AS_PATH: 64501 64500
Origin: IGP
Next_Hop: 192.0.2.5

At AS64502 (Transit Provider 2): Receives announcement from AS64501:

Network: 203.0.113.0/24
AS_PATH: 64502 64501 64500
Origin: IGP
Next_Hop: 192.0.2.10

At AS64503 (Destination AS): May receive the same route via multiple paths and selects the best one based on the BGP decision process. Shorter AS_PATH is typically preferred.

BGP Communities and ASNs

BGP communities are another way ASNs are used in routing policy. A BGP community is a 32-bit attribute that can be attached to routes for policy-based routing. The format is typically ASN:Value (e.g., 64500:100).

A standard community only has room for a 16-bit ASN. Holders of 32-bit ASNs, which covers every ASN the RIPE NCC issued in 2026, use BGP Large Communities (RFC 8092), written ASN:function:value, for example 4200000001:1:100.

Common community uses:

Traffic engineering: Mark routes for specific treatment
Geographic tagging: Indicate route origin region
Customer routing policies: Signal special handling requirements
Route filtering: Control route propagation

Well-known communities:

NO_EXPORT (65535:65281): Don't advertise to eBGP peers
NO_ADVERTISE (65535:65282): Don't advertise to any peer
NO_EXPORT_SUBCONFED (65535:65283, called LOCAL_AS on Cisco): Don't advertise outside the local AS

Why Organizations Need ASNs

Multi-homing Requirements

The most common reason to obtain an ASN is multi-homing: connecting to multiple upstream ISPs simultaneously.

Without an ASN (single-homed):

Use provider-assigned IP space
Routes announced by provider using their ASN
Single point of failure if provider link fails
No control over routing policies
Limited traffic engineering capabilities

With an ASN (multi-homed):

Can announce your own IP space via multiple providers
Automatic failover if one provider fails
Load balancing across multiple links
Independent routing policies

Unique Routing Policies

In the RIPE region multi-homing stays the condition for getting an ASN (ripe-679); ARIN issues a first ASN on request (NRPM 5). Once you hold one, other reasons to run it include:

Complex peering arrangements:

Direct peering with multiple networks
Participation in Internet Exchange Points (IXPs)
Content delivery network requirements

Traffic engineering needs:

Granular control over inbound and outbound traffic
Geographic load balancing
Cost optimization through preferred paths

Anycast implementations:

Same IP prefixes announced from multiple locations
Geographic routing to nearest location

Business and Operational Benefits

Having your own ASN provides:

Network independence:

Not tied to any single provider's infrastructure
Easier provider migration
Flexibility to change network architecture

Visibility and control:

Create ROAs that name your own ASN as origin, and an ASPA object listing your upstream providers
Control over route filtering and security

ASN Allocation and Management

ASNs are allocated and managed by the five Regional Internet Registries (RIRs):

RIPE NCC: Europe, the Middle East and parts of Central Asia
ARIN: United States, Canada, many Caribbean and North Atlantic islands
APNIC: Asia-Pacific
LACNIC: Latin America and the Caribbean
AFRINIC: Africa

Requirements differ by registry. The RIPE NCC requires the network to be multihomed and asks for its routing policy in RPSL (ripe-679); individuals and organizations can both hold an ASN. ARIN issues a first ASN to any organization on request (NRPM 5), provided it is legally formed in the ARIN region. APNIC asks for multihoming or a need to interconnect with other networks. LACNIC asks for interconnection within six months, and AFRINIC stopped requiring multihoming in May 2020.

A RIPE proposal, 2026-01, would drop the justification for a holder's first ASN, but it is in drafting and not policy as of September 2026. ASN Registration Requirements by RIR compares the five registries; how to get an ASN walks through the RIPE process.

ASN Security Considerations

Route Hijacking

Route hijacking occurs when an AS announces IP prefixes it doesn't own. This can happen accidentally (misconfiguration) or maliciously (attempting to intercept traffic).

Example attack: AS64999 announces 203.0.113.0/24 even though it's owned by AS64500. If AS64999 announces a more specific prefix (203.0.113.0/25), it may attract traffic due to longest-prefix matching.

RPKI (Resource Public Key Infrastructure)

RPKI is a security framework that allows origin AS validation. Network operators create Route Origin Authorizations (ROAs) that cryptographically attest which ASN is authorized to announce specific IP prefixes.

About two thirds of IPv4 route announcements (68.6% of prefix-origin pairs) and 77.3% of IPv6 announcements were RPKI-valid on 1 August 2026, according to the NIST RPKI Monitor. What is RPKI? explains ROAs and validation in detail.

RPKI validation states:

Valid: Route matches a ROA
Invalid: Route contradicts a ROA (wrong ASN or prefix too specific)
NotFound (shown as "unknown" by many tools): no ROA covers the prefix

Implementing RPKI:

Create ROAs for all your prefixes
Validate routes received from peers
Filter or deprioritize RPKI Invalid routes

ROAs protect prefixes. The RPKI object that protects your ASN itself is ASPA: a signed list of the providers allowed to carry your routes, which lets validators detect route leaks and forged paths. The RIPE NCC's hosted RPKI Dashboard has offered ASPA since late 2025, ARIN since January 2026 and APNIC since July 2026.

3,243 ASPA objects existed on 25 September 2026, against 556 at the end of 2025 (rpki-client console). The ASPA specifications are still IETF drafts, not RFCs. ASPA explained covers how to publish one.

IRR (Internet Routing Registry)

IRRs maintain databases of routing information including:

route objects: which ASN originates which prefixes
aut-num objects: Routing policy for ASNs
as-set objects: Groups of related ASNs

Maintaining accurate IRR records helps peers validate your routing announcements and build appropriate filters.

BGP Filtering Best Practices

Network operators should implement filtering to prevent routing issues:

Prefix filtering:

Filter bogon prefixes (unallocated, private, documentation ranges)
Implement maximum prefix length filters
Accept only expected prefixes from customers

AS_PATH filtering:

Filter private ASNs (64,512-65,534, 4,200,000,000-4,294,967,294)
Implement AS_PATH length limits
Prevent AS_PATH prepending abuse

RPKI validation:

Validate BGP routes against ROAs
Drop or deprioritize invalid routes

Real-World ASN Examples

Major Cloud Providers:

Amazon Web Services: AS16509 (primary), plus multiple others
Google: AS15169 (primary), AS36040, AS36384, and others
Microsoft Azure: AS8075 (primary), plus regional ASNs
Cloudflare: AS13335

Internet Service Providers:

AT&T: AS7018
Verizon: AS701
Level 3 (now Lumen): AS3356
Cogent: AS174

These large organizations often hold multiple ASNs for different regions, services, or business units.

Look any of them up with our ASN lookup tool, which shows the holder, announced prefixes and BGP neighbors.

Common Misconceptions About ASNs

Misconception 1: "ASNs are only for large ISPs" Many small networks hold one. The RIPE NCC issued 2,734 ASNs in the twelve months to 24 September 2026, and individuals can hold an ASN in the RIPE region.

Misconception 2: "Private ASNs work for Internet routing" Reality: Private ASNs must never appear in public Internet routing tables. They're filtered by most ISPs and cause routing failures if announced publicly.

Misconception 3: "You need an ASN to have your own IP addresses" Reality: You can have Provider Independent (PI) IP space without an ASN. However, without an ASN, you cannot multi-home or control routing of those addresses yourself.

Misconception 4: "An ASN can never change hands" In the RIPE region an ASN can be transferred under the transfer policy (ripe-807). A 32-bit ASN has no holding period, a 16-bit ASN cannot be transferred again for 24 months after it was received, and the RIPE NCC charges nothing for a transfer. ASNs also move between the RIPE NCC and ARIN or APNIC. LACNIC only moves ASNs through mergers and acquisitions, and AFRINIC has no transfer policy with the other RIRs.

Misconception 5: "BGP is only for ASN holders" Organizations can run internal BGP (iBGP) without a public ASN, using a private one, or participate in BGP routing using provider ASNs. Independent routing still requires your own public ASN.

Using Via-Registry Services

We are a RIPE NCC member LIR in France and sponsor ASNs in the RIPE region. An ASN costs €130 per year through us (€80 service fee plus the €50 RIPE NCC fee, as of September 2026), and individuals can hold one. New orders can prepay the second year for €234 in total, 20% off year two. Your ASN is typically live in 1 to 2 business days once your file is complete, RIPE NCC processing included. Details and the order form are on the ASN registration page. Other sponsoring LIRs' published prices are in our ASN sponsorship price comparison.

Frequently Asked Questions

Do I need an ASN if I only have one Internet connection?

Usually not. A single-homed network can use provider-assigned addresses announced under the provider's ASN. An Internet Exchange Point port or a second transit link changes that: it gives you two neighbors, which is the multi-homing the RIPE NCC asks for.

Can I use the same ASN in different regions?

Yes. ASNs are globally unique and work worldwide. If your organization operates in multiple geographic regions, you typically use the same ASN everywhere. The ASN is assigned by one RIR (usually where your headquarters is located) but is valid globally.

How do I find out what ASN an IP address belongs to?

Look up the prefix in RIPEstat or a BGP looking glass to see which ASN announces it today. The RIR database (whois) shows who the addresses are registered to, which is not always the network that announces them. From a shell, whois -h whois.radb.net 203.0.113.1 returns IRR route objects, which can be stale.

What happens if I accidentally announce someone else's IP space from my ASN?

Networks that validate RPKI drop the announcement when the prefix holder has a ROA for another origin, and peers with prefix filters ignore it. Where neither applies, part of the Internet sends the other network's traffic to you until you withdraw the route. Withdraw it, tell your upstreams, and filter your own announcements against a prefix list built from your route objects and ROAs.

Can I change my ASN after receiving it?

An ASN stays with the holder it was assigned to. You cannot "change" your ASN to a different number except in rare circumstances. If you no longer need an ASN, you should return it to the RIR. If you need a different ASN, you would apply for a new one and eventually return the old one.

How long does an ASN remain valid?

An ASN has no expiry date. It stays registered while you hold a contract with a sponsoring LIR or with the RIPE NCC and the yearly fees are paid. Under the RIPE NCC Charging Scheme 2026 (ripe-848), an LIR pays €50 per ASN per year. The RIPE NCC also reclaims ASNs that are never announced. If your LIR closes or stops sponsoring you, the RIPE NCC gives you 10 working days, then 10 more, before deregistration starts: change your sponsoring LIR inside that window.

Summary

An ASN is the number BGP uses to tell networks apart: it marks where a route starts and every network it crosses. You need a public one once you announce your own addresses through two or more networks. In the RIPE region that means a multi-homed setup and, without RIPE NCC membership, a sponsoring LIR.

What is an ASN (Autonomous System Number)? Understanding BGP Routing