Provider and network operator

An ISP provides internet access. An ASN identifies an autonomous system used in internet routing. A lookup may show an organization, retail access brand, or upstream operator. The brand on your bill and the network name in a database do not have to match.

What an ASN is useful for

When examining many IPs, an ASN helps group addresses at the network level. Different addresses can belong to the same autonomous system. However, one ASN can serve many customers and services; a single negative event should not be attributed to every address in that network.

Investigate unexpected names

Cloud hosting, VPNs, and corporate gateways can show another organization instead of your home ISP. Verify the connection and queried address first. Interpret ASN and country information together: an organization’s headquarters country is not the location of every server or user it serves.

One ASN, different users

Ten log entries may share an ASN because their addresses use one operator’s network, not because they belong to one person. In an abuse investigation, combine ASN information with times, request paths, and application behavior. Before blocking an entire network, account for legitimate customers who may use that same operator.

Further reading

Autonomous systems — RFC 1930 ↗

Put it into practice

Inspect one public IP, or compare a list of addresses with the bulk lookup tool. Location results are approximate.

Single lookup ↗ Bulk lookup ↗