Glossary
What Is an Autonomous System (ASN)?
An Autonomous System is a network — or group of IP prefixes — operated by a single organization with one consistent routing policy. Each AS is identified by a unique Autonomous System Number (ASN) assigned by a Regional Internet Registry, and uses BGP to exchange routes with other ASNs.
How Whisper models it
An ASN is a first-class node; ROUTES edges connect it to every prefix it announces.
MATCH (a:ASN {name:"AS13335"})-[:ROUTES]->(p:ANNOUNCED_PREFIX) RETURN count(p) AS prefixesHow ASNs Are Allocated
ASNs are issued by the five Regional Internet Registries (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) to network operators — ISPs, hosting providers, large enterprises, content networks. There are two flavors:
- 16-bit ASNs (1 – 65535) — the original numbering space; mostly exhausted.
- 32-bit ASNs (65536+) — the modern allocation space.
- Private ASNs (64512 – 65534, 4200000000 – 4294967294) — used inside organizations and never appear on the public internet.
Why ASNs Matter for Security
Every public IP belongs to an ASN. That single piece of context tells you a lot:
- Ownership — who runs the network the IP sits on.
- Reputation — some ASNs host overwhelmingly legitimate traffic; others are repeat offenders.
- Geography and jurisdiction — useful for compliance, takedowns, and threat attribution.
- Routing behavior — withdrawals, hijacks, and unusual peer changes are visible at the ASN level.
Bulletproof and Abuse-Tolerant ASNs
Some ASNs are well-known for hosting phishing kits, command-and-control servers, malware, or content that gets quickly removed elsewhere. Mapping which ASNs concentrate abuse — and how aggressively they take it down — is a foundational piece of threat-intelligence work.
BGP and ASN Relationships
BGP is how ASNs talk to each other. Each ASN announces the IP prefixes it routes; peers and transit providers propagate those announcements. The relationships between ASNs (peer, customer, provider) are usually inferred from observed routing data — they are rarely published directly.
ASNs in Whisper
Whisper treats IPV4, IPV6, CIDR, and ASN as first-class data types. Range queries, containment checks, and ASN traversals are instant. Analysts pivot from a single suspicious IP to the full ASN, the prefixes it announces, the upstream peers, and the historical routing changes — without writing joins by hand.
See it in practice
Run it live in these use cases: Spot BGP hijacks & route anomalies.
Where this shows up
See it in a live investigation: Map an org’s infrastructure concentration risk, Find the real infrastructure behind the CDN, Enrich an ASN — routing, RPKI & physical footprint.
Go hands-on with the compliance recipes, the recon recipes and the BGP & routing recipes.