AS / ASN / BGP Routing — Understanding the Internet's Backbone

I. What Is an AS — Autonomous System

An AS (Autonomous System) is a network or group of networks under a single administrative routing policy. What routing protocol an AS uses internally (OSPF / IS-IS) is its own business, but between ASes, BGP is used to publicly announce IP prefixes.

• A large ISP is itself an AS (China Telecom AS4134, China Unicom AS4837, China Mobile AS9808)
• A major cloud provider is an AS (Google AS15169, Cloudflare AS13335, AWS AS16509)
• Universities, governments, and large enterprises can own their own AS
• A regular home broadband user's IP is carved out of their ISP's AS — end users don't need their own AS

1.1 Who Assigns ASNs

ASNs (AS numbers) are managed by 5 Regional Internet Registries (RIRs):

ASNs were originally 16-bit (0-65535, which started running tight after 1996); today they're 32-bit (0-4294967295, RFC 6793). Roughly 120,000 are actually in use worldwide today.

1.2 How to Read an ASN — Formats

Modern usage just uses the plain numeric format. The "AS" prefix can be omitted, but writing it out is clearer.

II. BGP — the Internet's "Postal Code System"

BGP (Border Gateway Protocol), RFC 4271, is the only routing protocol used between ASes. Each AS uses BGP to announce to its neighbor ASes: "I can reach these IP prefixes, and through me you can reach these ASes further along."

2.1 The Core of a BGP Announcement: Prefix + AS-PATH

Prefix                Next Hop          AS-PATH
104.16.0.0/13    203.0.113.1   AS3356 AS13335   ← via Lumen to Cloudflare
104.16.0.0/13    198.51.100.5   AS6939 AS13335   ← via HE.net to Cloudflare
8.8.8.0/24      203.0.113.1   AS3356 AS15169   ← to Google DNS
202.106.0.0/16  198.51.100.5   AS6939 AS4847 AS4134 ← to China Telecom Beijing

The AS-PATH lists every AS traversed from the origin AS (the prefix's owner) to the current router. Read it right to left — the rightmost AS is the origin, the leftmost is the neighbor.

2.2 How BGP Chooses the Best Path

When multiple paths exist for the same prefix, BGP picks one using this priority order (summarized):

1. LOCAL_PREF: higher is better — internal preference within the AS (who gets used first)
2. Shorter AS-PATH is better — fewer ASes traversed wins
3. Origin: IGP (internal) > EGP > Incomplete
4. MED (Multi-Exit Discriminator): lower is better — a hint passed between ASes
5. eBGP > iBGP
6. IGP cost: lower is better
7. Router ID: lower is better (final tiebreaker)

Note: BGP doesn't necessarily pick the fastest path. A shorter AS-PATH doesn't mean lower physical latency. An intercontinental route through 1 AS can be slower than a same-city route through 3 ASes.

III. Tier 1 / Tier 2 / Tier 3 — ISP Hierarchy

All ASes fall into three tiers based on whether they have to pay for upstream transit:

Typical home broadband packet path: your home → local small ISP (Tier 3) → provincial / metro network (Tier 2) → China Telecom backbone (Tier 1) → overseas Tier 1 → destination network.

IV. Testing It Yourself — Which ASes Between Home and Google

Use mtr -bz (BSD: traceroute -A) to see the AS number for every hop:

HOST: xxx                Loss%   Snt   Last  Avg   ASN
1.  192.168.1.1                0.0%   10   0.5  0.6   (private network, no ASN)
2.  61.183.x.x                 0.0%   10   3.2  3.5   AS4134  China Telecom
3.  202.97.x.x                 0.0%   10   5.1  5.4   AS4134  China Telecom backbone
4.  202.97.x.x                 0.0%   10  15.2  16.1  AS4134
5.  202.97.x.x                 0.0%   10  45.3  46.0  AS4134  pre-egress node
6.  211.95.x.x                 0.0%   10 156.4 158.2  AS4134  international gateway
7.  72.14.215.x                0.0%   10 158.1 159.8  AS15169 Google network
8.  142.250.x.x                0.0%   10 159.8 161.2  AS15169 Google
9.  142.250.x.x (www.google.com)  0.0%   10 160.2 162.0  AS15169

From this mtr trace, we can see:

• Home → China Telecom local network (AS4134, hops 2-3): < 10ms
• China Telecom backbone (AS4134, hops 4-6): 5-150ms
• International gateway hop to Google (AS15169, hop 7): sudden jump to 150+ms ← international egress latency
• Inside Google (AS15169, hops 8-9): < 5ms

From Chinese home broadband to Google crosses just 2 ASes — an extremely short AS-PATH — yet the physical latency is high. This is exactly what we mean by "BGP length isn't physical latency."

V. BGP's Two Security Nightmares — Route Leaks and Route Hijacking

5.1 Route Leak

An AS mistakenly passes routes that shouldn't go to an upstream up to an upstream or neighbor, sending global traffic down the wrong path. A classic example: an ISP mistakes a customer's routes for its own routes and announces them to everyone.

Notable incident: In November 2017, a Level3 (AS3356) route leak disrupted large numbers of downstream Comcast and Verizon customers.

5.2 BGP Hijack

A malicious AS announces IP prefixes it doesn't own. Once other ASes accept the announcement, traffic gets redirected to the hijacker, enabling MITM, denial of service, or DNS poisoning.

Notable incidents:

• 2008: Pakistan's PTCL announced YouTube's prefix, redirecting global YouTube traffic to Pakistan for 2 hours
• 2018: eNet (AS10297) announced Amazon Route 53's DNS prefixes, hijacking MyEtherWallet user traffic for roughly 2 hours
• 2022: Russia's RTCOMM briefly hijacked a Twitter prefix

5.3 Defense — RPKI Signs Routes

RPKI (Resource Public Key Infrastructure), the RFC 6480 series, lets the legitimate holder of an IP prefix cryptographically sign "this prefix may only originate from this AS." BGP routers that support RPKI drop routes that are unsigned or incorrectly signed.

Roughly half of all global IPv4 prefixes are now RPKI-signed, and the share keeps climbing. When you look up an IP on cleanip.io, the "AS Info" card shows its RPKI status: valid / invalid / not-found.

VI. How to Look Up Which ASN an IP or Domain Belongs To

6.1 Look It Up Directly on cleanip.io

Just visit https://cleanip.io/8.8.8.8 or https://cleanip.io/AS15169 — we show the full ASN info, registration date, IP ranges, upstream/downstream, and geographic distribution.

6.2 BGP Visualization on cleanip.io

/asn-graph draws the BGP topology for any ASN — from Origin through Tier 2 to Tier 1, so you can see at a glance who's peering with whom.

/asn-history shows the historical ownership of an IP / CIDR — which ASes a CIDR has belonged to over time, and when it changed.

6.3 Command-Line Tools

$ whois -h whois.cymru.com " -v 8.8.8.8"
AS      | IP        | BGP Prefix    | CC | Registry | Allocated  | AS Name
15169   | 8.8.8.8   | 8.8.8.0/24    | US | arin     | 1992-12-01 | GOOGLE, US

$ curl https://api.bgpview.io/ip/8.8.8.8 | jq
{
  "data": {
    "ip": "8.8.8.8",
    "prefixes": [{
      "asn": { "asn": 15169, "name": "Google LLC" },
      "prefix": "8.8.8.0/24"
    }]
  }
}

VII. Common ASN Quick Reference

VIII. Why This Matters for Everyday Users Too

• Risk-control systems look at ASN when scoring IP reputation — datacenter ASNs (cloud/VPN providers) typically score lower; residential broadband ASNs (China Telecom / Unicom) score higher
• When choosing a CDN for cross-border traffic, check the AS distance between your target users' ASN and the CDN's nodes — cleanip.io tells you which AS an IP belongs to in one lookup
• During a DDoS attack, ASN is the first clue for tracing the source — e.g. "most attack traffic originated from AS46562 Performive datacenter"
• When choosing a VPN, check which IDC's ASN it's hosted on — see VPN tracing for details