Glossary
What Is an Autonomous System (ASN)?
An Autonomous System is a network — or group of IP prefixes — operated by a single organization with one consistent routing policy. Each AS is identified by a unique Autonomous System Number (ASN) assigned by a Regional Internet Registry, and uses BGP to exchange routes with other ASNs.
How ASNs Are Allocated
ASNs are issued by the five Regional Internet Registries (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) to network operators — ISPs, hosting providers, large enterprises, content networks. There are two flavors:
- 16-bit ASNs (1 – 65535) — the original numbering space; mostly exhausted.
- 32-bit ASNs (65536+) — the modern allocation space.
- Private ASNs (64512 – 65534, 4200000000 – 4294967294) — used inside organizations and never appear on the public internet.
Why ASNs Matter for Security
Every public IP belongs to an ASN. That single piece of context tells you a lot:
- Ownership — who runs the network the IP sits on.
- Reputation — some ASNs host overwhelmingly legitimate traffic; others are repeat offenders.
- Geography and jurisdiction — useful for compliance, takedowns, and threat attribution.
- Routing behavior — withdrawals, hijacks, and unusual peer changes are visible at the ASN level.
Bulletproof and Abuse-Tolerant ASNs
Some ASNs are well-known for hosting phishing kits, command-and-control servers, malware, or content that gets quickly removed elsewhere. Mapping which ASNs concentrate abuse — and how aggressively they take it down — is a foundational piece of threat-intelligence work.
BGP and ASN Relationships
BGP is how ASNs talk to each other. Each ASN announces the IP prefixes it routes; peers and transit providers propagate those announcements. The relationships between ASNs (peer, customer, provider) are usually inferred from observed routing data — they are rarely published directly.
ASNs in Whisper
Whisper treats IPV4, IPV6, CIDR, and ASN as first-class data types. Range queries, containment checks, and ASN traversals are instant. Analysts pivot from a single suspicious IP to the full ASN, the prefixes it announces, the upstream peers, and the historical routing changes — without writing joins by hand.