ASN Lookup
Which network announces an address, and which prefix it sits in.
How the internet decides where a packet goes
There is no map. No central authority knows the route from one address to another. What exists is about 75,000 autonomous systems — ISPs, hosting companies, universities, banks — each announcing to its neighbours which address ranges it will carry traffic for, and each deciding for itself which of the announcements it hears to believe.
That protocol is BGP, and the arrangement is considerably more improvised than the phrase “internet infrastructure” suggests. It works because networks have commercial reasons to behave and because most of them filter their neighbours’ announcements sensibly.
Which is why routing is done on prefixes rather than addresses. Nobody announces 8.8.8.8; Google announces 8.8.8.0/24, and every router in the world stores one entry rather than 256. The lookup above shows which prefix your address actually falls inside — often larger than you would guess.
Why a /24 is the floor
The global routing table is around a million entries and every router on the internet holds all of it in fast memory. To keep that finite, most operators filter announcements longer than a /24 in IPv4.
The practical effect is that you cannot announce a handful of addresses. A /24 is the minimum that will propagate, which is why getting your own address space is a meaningful undertaking — the registries ran out of IPv4 years ago, so a /24 now comes from the transfer market at a price that has only gone one way.
What the AS tells you, and what it does not
It is worth separating two things that get conflated constantly.
| ASN lookup | Geolocation | |
|---|---|---|
| Answers | Which network announces this address | Where the address is probably used |
| Based on | Live BGP announcements | Registration data and latency inference |
| Reliability | Precise — it is a routing fact | Country usually right, city often wrong |
So “who operates this address” is answerable with confidence. “Where is this person” is not, and the two are routinely presented as though they were the same lookup.
This is how VPN detection works
Worth stating plainly, because it is more mundane than most explanations suggest. A site that wants to know whether you are on a VPN does not analyse your traffic. It looks up the ASN of your address and checks it against a list of hosting providers and known VPN operators.
A residential connection is announced by a consumer ISP. A VPN exit node is announced by a datacenter. The two look nothing alike at this layer, and the check costs a database lookup.
It is not conclusive — plenty of legitimate business traffic originates in datacenters, and some operators use residential address space specifically to avoid this. But it explains why VPN detection is common and cheap, and why it has nothing to do with the strength of the encryption.
When routing goes wrong
BGP has no built-in authentication. A network announcing a prefix it does not own will be believed by anyone who does not filter it, and traffic for that prefix goes to the wrong place. This has happened at scale more than once — a misconfiguration at one operator has taken large parts of the web offline, and deliberate hijacks have been used to intercept traffic.
The fix in deployment is RPKI: address holders cryptographically sign which AS may announce their prefixes, and networks reject announcements that fail validation. Adoption is now substantial among large operators, which has made hijacks meaningfully harder than they were a decade ago.
If the lookup above reports several AS numbers for one prefix, anycast is by far the likeliest explanation. It is only a concern when the networks involved have no plausible relationship.
Related
For the geographic side of an address — with the accuracy caveats that belong to it — the IP lookup covers it. To work out which prefix an address falls in yourself, the subnet calculator does the arithmetic.
Routing questions
What is an autonomous system?
A network under one administrative authority that decides its own routing policy — an ISP, a large hosting provider, a university, a bank. Each has a number, and BGP is how they tell each other which address ranges they will carry traffic for. The internet is roughly 75,000 of these agreeing to route for one another, which is a more improvised arrangement than most people assume.
Is this the same as an IP geolocation lookup?
No, and the difference is worth being clear about. This tells you which network announces the address, which is a routing fact and is precise. Geolocation guesses where the address is physically used, which is an inference from registration data and observed latency, and is frequently wrong at city level. If you want to know who operates an address, ASN is the reliable answer; if you want to know where someone is, neither is as reliable as people assume.
Why does one address show several AS numbers?
Usually anycast — the same prefix announced from many locations at once, which is how Cloudflare, Google DNS and most CDNs work. It can also mean a multi-homed network announcing through more than one upstream. Occasionally it is a route leak or a hijack, where somebody announces a prefix they have no right to; that is rarer, and it is exactly what RPKI exists to prevent.
What is the smallest prefix that gets routed?
A /24 in IPv4, in practice. Most operators filter anything longer to keep the global routing table manageable, so announcing a /25 will not propagate even though it is technically valid. This is why buying a handful of IP addresses does not let you announce them yourself — you need at least a /24, and increasingly you need to acquire it on the transfer market, since the registries ran out.
Can I tell whether an IP belongs to a VPN or a datacenter?
The AS is a strong hint. An address announced by a hosting provider or a known VPN operator is almost certainly not a residential connection, and this is exactly how sites detect VPN use — they check the ASN against a list. It is not conclusive: businesses buy transit from hosting providers, and some VPN operators use residential address space. What it does show is that "which network is this" is a much easier question to answer than most people expect.
The AS behind an address is how sites tell a datacenter connection from a residential one — it is the usual basis for VPN detection, and it is a lookup anyone can do. See what your own address says
Last reviewed . Found something out of date? Tell us.