Type an IP reside into a basal lookup tool, and you'll usually get a city, possibly an ISP name. But that's only half the picture. Behind almost each IP reside is simply a bigger building called an Autonomous System, and if you want to cognize who really controls a chunk of the internet, that's wherever you request to look.
An ASN lookup is simply a query that reveals which statement owns and operates a circumstantial web connected the internet, on pinch each IP scope that web advertises. It goes 1 level deeper than a normal IP lookup, and erstwhile you understand it, a batch of networking and information activity gets a batch easier.
This guideline breaks down what an ASN really is, why group hunt for this information, and really to tally a lookup yourself, nary networking grade required.
What Is an ASN, Exactly?
An ASN (Autonomous System Number) is simply a unsocial ID assigned to a web operator, for illustration an ISP, a unreality provider, aliases a ample company, that identifies the postulation of IP reside ranges they power connected the internet.
Think of the net arsenic thousands of smaller networks stitched together. Each of those networks needs a measurement to say, "These IP addresses beryllium to me, which way postulation here." That's precisely what an ASN does. It's the internet's type of a institution registration number, isolated from alternatively of registering a business, you're registering a network.
Every ASN is issued by 1 of 5 Regional Internet Registries (RIRs), depending connected wherever the statement is based:
- ARIN: North America
- RIPE NCC: Europe, the Middle East, and Central Asia
- APNIC: Asia-Pacific
- LACNIC: Latin America and the Caribbean
- AFRINIC: Africa
So erstwhile you look up an ASN, you're really querying whichever registry primitively allocated it. That's an important detail, because it's besides why immoderate free devices springiness incomplete answers. If a instrumentality only checks 1 registry, it'll miss a immense chunk of the internet.
Why Would You Look Up an ASN?
In my experience, group seldom hunt for "ASN lookup" retired of axenic curiosity. There's usually a circumstantial problem down it. Here are the astir communal ones:
- Security investigations. An IP reside connected its ain tells you very little. But erstwhile you cognize which web it belongs to, you tin show if it's coming from a known hosting provider, a residential ISP, aliases a web pinch a history of abuse.
- BGP monitoring. Network engineers way which IP ranges an ASN is announcing complete time. If caller ranges show up unexpectedly aliases aged ones disappear, that's worthy investigating.
- Threat intelligence. Security teams often artifact aliases emblem postulation astatine the web level alternatively than the individual IP level, since attackers rotate IPs perpetually but seldom alteration networks.
- Infrastructure research. Developers and analysts usage ASN information to representation retired who's really moving the infrastructure down a website, an app, aliases a suspicious login attempt.
Developers often stumble onto ASN lookups while debugging thing other entirely, for illustration why a user's postulation is being geolocated to the incorrect country, only to find the IP artifact itself is registered location unexpected.
What Information Does an ASN Lookup Actually Return?
This is wherever a batch of free devices autumn short. A basal ASN lookup mightiness conscionable manus you a sanction and a country. A due one, for illustration the consequence you'd get from APIFreaks, gives you the afloat web profile.
Here's what a complete ASN lookup should include:
Data Point | What It Tells You |
Organization sanction & WHOIS record | Who legally owns and registered the ASN |
Allocation day & type | When it was assigned, and whether it's an ISP, business, government, aliases acquisition network |
IPv4 and IPv6 CIDR blocks | Every reside scope the ASN presently advertises |
Upstream providers | Who carries this network's postulation to the remainder of the internet |
Downstream networks | Who this web provides transit to |
BGP peers | Direct neighbors this ASN exchanges postulation with |
Raw WHOIS text | The unprocessed registry record, useful for audits aliases documentation |
That combination, ownership positive routing positive relationships, is what turns a elemental lookup into thing you tin really build information aliases investigation workflows around.
How to Perform an ASN Lookup
You don't request immoderate coding inheritance to do a basal lookup, but if you're integrating this into an exertion aliases a information pipeline, an API is the applicable route. Here's really it useful measurement by step.
Step 1: Get the AS number. If you already cognize it, great. If you're starting from an IP reside instead, astir IP geolocation devices will manus you the ASN arsenic portion of the response. APIFreaks' IP Geolocation API, for example, returns the ASN straight successful its response, truthful you tin propulsion it and provender it consecutive into an ASN lookup.
Step 2: Query the ASN. Using the APIFreaks ASN Lookup API, you nonstop a elemental petition pinch the AS number, formatted pinch aliases without the "AS" prefix (both AS1234 and 1234 activity the aforesaid way).
curl -X 'GET' 'https://api.apifreaks.com/v1.0/asn/whois/live?asn=AS1234&apiKey=API-KEY' |
Step 3: Read the response. A system consequence typically includes fields for illustration the statement name, country, allocation date, and arrays for advertised routes and BGP relationships. You don't request to parse earthy WHOIS matter by hand; the system fields do that activity for you.
Step 4: Act connected the data. Depending connected your usage case, that mightiness mean flagging postulation from a circumstantial network, logging a caller prefix for monitoring, aliases simply documenting who owns an reside scope for a report.
A Quick Example
Say you're looking up AS1234. Here's what a real, unrecorded consequence from the ASN Lookup API looks like:
{ "asNumber": "1234", "asName": "FORTUM-AS", "orgName": "Fortum", "description": "Fortum", "orgHandle": "FORTUM-AS", "country": "NL", "domain": null, "website": "", "allocationStatus": "LEGACY", "numOfIPv4Routes": "3", "numOfIPv6Routes": "0", "whoisHost": "RIPE", "dateAllocated": "2002-07-01", "type": "BUSINESS", "routeObjects": [ { "route": "137.96.0.0/16", "origin": "AS1234", "originName": "Fortum", "isp": "Fortum Oyj", "numberOfIps": 65536 }, { "route": "193.110.32.0/21", "origin": "AS1234", "originName": "Fortum", "isp": "Fortum Oyj", "numberOfIps": 2048 }, { "route": "132.171.0.0/16", "origin": "AS1234", "originName": "Fortum", "isp": "Fortum Oyj", "numberOfIps": 65536 } ], "whoisResponse": "% This is the RIPE Database query service.\n% The objects are successful RPSL format.\n%\n% The RIPE Database is taxable to Terms and Conditions.\n% See https://docs.db.ripe.net/terms-conditions.html\n\n% Note: this output has been filtered.\n% To person output for a database update, usage the \"-B\" flag.\n\n% Information related to 'AS1234 - AS1235'\n\nas-block: AS1234 - AS1235\ndescr: RIPE NCC ASN block\nremarks: These AS Numbers are assigned to web operators successful the RIPE NCC work region.\nmnt-by: RIPE-NCC-HM-MNT\ncreated: 2018-11-22T15:27:09Z\nlast-modified: 2018-11-22T15:27:09Z\nsource: RIPE\n\n% Information related to 'AS1234'\n\n% No maltreatment interaction registered for AS1234\n\naut-num: AS1234\nas-name: FORTUM-AS\ndescr: Fortum\ndescr: Fortum's Internet access\nimport: from AS6667\n action pref=100;\n judge ANY\nimport: from AS1759\n action pref=100;\n judge ANY\nexport: to AS6667\n denote AS1234\nexport: to AS1759\n denote AS1234\nadmin-c: TT18-RIPE\ntech-c: JK6864-RIPE\ntech-c: KS2114-RIPE\nstatus: LEGACY\nmnt-by: TE-ENERGY-NOC\ncreated: 2002-07-01T06:59:10Z\nlast-modified: 2017-11-15T09:13:23Z\nsource: RIPE # Filtered\n\nperson: Jari Kuusikoski\naddress: Tietoevry Tech Services Finland Oy\naddress: Keilalahdentie 2\naddress: P.O. BOX 2\naddress: FI-02101 ESPOO\naddress: Finland\nphone: +358 40 5477 306\nnic-hdl: JK6864-RIPE\nmnt-by: DATANET-NOC\nmnt-by: TE-ENERGY-NOC\ncreated: 2002-06-25T12:30:09Z\nlast-modified: 2024-01-02T14:44:59Z\nsource: RIPE # Filtered\n\nperson: Kalevi Sinkko\naddress: TietoEnator\naddress: Aku Korhosentie 2\naddress: 00441 Helsinki\nphone: +358207269560\nfax-no: +358-2072 69400\nnic-hdl: KS2114-RIPE\nmnt-by: DATANET-NOC\nmnt-by: TE-ENERGY-NOC\ncreated: 2002-06-24T08:06:29Z\nlast-modified: 2006-07-21T06:06:14Z\nsource: RIPE # Filtered\n\nperson: Tarmo Tuomi\naddress: TietoEnator Co\naddress: Aku Korhosentie 2\naddress: FIN-00441 HELSINKI\naddress: FINLAND\nphone: +358-207269559\nfax-no: +358-2072 69400\nnic-hdl: TT18-RIPE\ncreated: 2002-06-17T09:38:57Z\nlast-modified: 2016-04-05T14:33:28Z\nmnt-by: RIPE-NCC-LOCKED-MNT\nsource: RIPE # Filtered\n\n% This query was served by the RIPE Database Query Service type 1.123 (SHETLAND)\n\n\n\n#\n# ARIN WHOIS information and services are taxable to the Terms of Use\n# disposable at: https://www.arin.net/resources/registry/whois/tou/\n#\n# If you spot inaccuracies successful the results, please study at\n# https://www.arin.net/resources/registry/whois/inaccuracy_reporting/\n#\n# Copyright 1997-2026, American Registry for Internet Numbers, Ltd.\n#\n\n\nASNumber: 1234 - 1235\nASName: RIPE-ASNBLOCK-1234\nASHandle: AS1234\nRegDate: 2002-10-15\nUpdated: 2003-04-25\nComment: These addresses person been further assigned to users in\nComment: the RIPE NCC region. Contact accusation tin beryllium recovered in\nComment: the RIPE database astatine http://www.ripe.net/whois\nRef: https://rdap.arin.net/registry/autnum/1234\n\nResourceLink: https://apps.db.ripe.net/db-web-ui/query\nResourceLink: whois.ripe.net\n\n\nOrgName: RIPE Network Coordination Centre\nOrgId: RIPE\nAddress: P.O. Box 10096\nCity: Amsterdam\nStateProv: \nPostalCode: 1001EB\nCountry: NL\nRegDate: \nUpdated: 2013-07-29\nRef: https://rdap.arin.net/registry/entity/RIPE\n\nReferralServer: whois.ripe.net\nResourceLink: https://apps.db.ripe.net/db-web-ui/query\n\nOrgAbuseHandle: ABUSE3850-ARIN\nOrgAbuseName: Abuse Contact\nOrgAbusePhone: +31205354444 \nOrgAbuseEmail: [email protected]\nOrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE3850-ARIN\n\nOrgTechHandle: RNO29-ARIN\nOrgTechName: RIPE NCC Operations\nOrgTechPhone: +31 20 535 4444 \nOrgTechEmail: [email protected]\nOrgTechRef: https://rdap.arin.net/registry/entity/RNO29-ARIN\n\n\n#\n# ARIN WHOIS information and services are taxable to the Terms of Use\n# disposable at: https://www.arin.net/resources/registry/whois/tou/\n#\n# If you spot inaccuracies successful the results, please study at\n# https://www.arin.net/resources/registry/whois/inaccuracy_reporting/\n#\n# Copyright 1997-2026, American Registry for Internet Numbers, Ltd.\n#\n", "downstreams": [], "parsedWhoisResponse": { "status": true, "whois_server": "whois.arin.net", "aut_nums": [ { "aut_num": "1234 - 1235", "as_handle": "AS1234", "as_name": "RIPE-ASNBLOCK-1234", "tech_contacts": [ "RNO29-ARIN" ], "abuse_contacts": [ "ABUSE3850-ARIN" ], "date_created": "2002-10-15", "date_updated": "2003-04-25", "source": "https://rdap.arin.net/registry/autnum/1234" } ], "organization": { "handle": "RIPE", "name": "RIPE Network Coordination Centre", "address": [ "P.O. Box 10096", "Amsterdam", "1001EB", "NL" ], "city": "Amsterdam", "zip_code": "1001EB", "country": [ "NL" ], "date_updated": "2013-07-29", "source": "https://rdap.arin.net/registry/entity/RIPE", "addressCountry": "NL" }, "technical_contacts": [ { "handle": "RNO29-ARIN", "name": "RIPE NCC Operations", "email": [ ], "phone": [ "+31 20 535 4444" ], "source": "https://rdap.arin.net/registry/entity/RNO29-ARIN" } ], "abuse_contacts": [ { "handle": "ABUSE3850-ARIN", "name": "Abuse Contact", "email": [ ], "phone": [ "+31205354444" ], "source": "https://rdap.arin.net/registry/entity/ABUSE3850-ARIN" } ] }, "upstreams": [ { "asNumber": "AS1759", "description": "Telia Finland Oyj", "country": "FI" }, { "asNumber": "AS719", "description": "Elisa Oyj", "country": "FI" } ], "peers": [ { "asNumber": "AS6667", "description": "Elisa Oyj", "country": "FI" }, { "asNumber": "AS1759", "description": "Telia Finland Oyj", "country": "FI" }, { "asNumber": "AS719", "description": "Elisa Oyj", "country": "FI" } ], "contacts": { "emailContacts": [], "abuseContacts": [] }, "legacyRoutes": [] } |
In 1 call, you get the statement sanction (Fortum), the state it's registered in, erstwhile the ASN was allocated, and each web it connects to directly, some its upstream providers and its BGP peers. The afloat consequence besides includes the complete earthy WHOIS matter and further registry interaction details, but moreover this trimmed position already tells you much than a plain IP lookup ever could.
Instead of digging done earthy registry matter statement by line, you get each of that successful a clean, system format you tin driblet consecutive into a script, a dashboard, aliases a report.
Common Mistakes People Make With ASN Lookups
Mistake | Consequence |
Assuming IP location and ASN state ever match | Leads to incorrect conclusions during fraud aliases information checks |
Using a instrumentality that only checks 1 RIR | Missing information for ASNs registered extracurricular that region |
Ignoring BGP relationships | Missing discourse connected really postulation really reaches a network |
Treating ASN information arsenic static | Networks alteration their advertised ranges much often than group expect |
FAQs
What's the quality betwixt an ASN lookup and an IP lookup?
An IP lookup tells you astir 1 circumstantial address, usually its approximate location and the ISP it's assigned to. An ASN lookup goes broader: it tells you astir the full web usability down that IP, including each reside scope they power and who they link to.
Can I do an ASN lookup without immoderate coding?
Yes.browser-based devices fto you type successful an AS number aliases IP reside and get results instantly. Coding only becomes basal if you want to automate lookups aliases propulsion this information into your ain application.
What is BGP, and why does it travel up successful ASN lookups?
BGP (Border Gateway Protocol) is really networks show each different which IP ranges they ain and really to way postulation to them. It's the system that makes ASN information meaningful, since it's virtually what connects 1 Autonomous System to another.
Conclusion
An ASN lookup answers a mobility a basal IP lookup can't: who really runs this portion of the internet? Whether you're investigating suspicious traffic, monitoring web changes, aliases conscionable funny who's down an IP range, knowing really to publication ASN information turns a vague IP reside into thing you tin really enactment on.
English (US) · 
Indonesian (ID) · 
