Autonomous systems (ASNs), the internet's building blocks

In Series A we said the internet is "networks of networks." That's structurally true. But the units those networks come in have a specific name and a specific identifier: autonomous systems.

If IP addresses identify hosts, autonomous systems identify networks. Every meaningful piece of internet infrastructure is part of some AS. Understanding ASes is the first step toward understanding how the internet's routing actually works.

How ASes fit together

Each AS is a network under one administrative control. ASes connect to each other and announce which IP ranges they own. BGP carries those announcements.

What an AS is

An autonomous system (AS) is a network or group of networks under a single administrative control, with a single coherent routing policy.

A single ISP is an AS. A large company with its own internet edge is an AS. A university network is an AS. A cloud provider is one or more ASes.

What makes a network an AS:

• It connects to the public internet.
• It has its own routing policy (which routes it accepts from whom, which it announces to whom).
• It has a public identifier: an AS number.

Each AS controls one or more IP prefixes: blocks of contiguous IP addresses. The AS announces these prefixes to its neighbors via BGP, saying "I can reach these prefixes." Neighbors propagate the announcements onward.

The result: every IP address on the internet maps to exactly one origin AS (the AS that announces the prefix containing it).

AS numbers

AS numbers are 32-bit integers, written either:

• Plain: 15169, 13335, 64500.
• Asdot notation (for 4-byte ASNs): 1.0, 1.1234.

The first 16-bit range (0 to 65535) is the original 2-byte ASN space. There are about 65,000 of these and they were allocated early. Now the 4-byte ASN space is in use (up to 4.3 billion), so newer AS numbers are larger.

Some examples (publicly known):

AS number	Network
7922	Comcast Cable
15169	Google
13335	Cloudflare
16509	Amazon AWS
32934	Facebook
8075	Microsoft
36351	SoftLayer / IBM Cloud
14061	DigitalOcean
16276	OVH

Some are reserved:

• 64512-65534: private ASN space, for internal use (analogous to private IP ranges).
• 4200000000-4294967294: more private ASN space (4-byte).

If you're running an internal network and need ASNs for testing or for iBGP, use these private ranges.

How ASNs get assigned

The hierarchy parallels IP allocation:

1. IANA holds the global ASN pool.
2. Regional internet registries (ARIN, RIPE, APNIC, etc.) get blocks.
3. Networks apply to their region's RIR for an ASN.

Getting an ASN requires:

• Justification: you have multi-homed network (connections to multiple upstream providers) or otherwise need to be visible on the public internet.
• Membership in your RIR (typically a small annual fee).
• Demonstrating you have IP space to announce (or are about to).

Cost is modest, in the few hundred dollars per year range. The barrier is mostly demonstrating the need, not the money.

For an ordinary hosting customer, you don't need your own ASN. Your hosting provider has one, and your services are announced under their ASN. You'd want your own ASN if:

• You're running an ISP or hosting business.
• You're multi-homed (connecting to multiple upstreams independently).
• You want to manage your own routing policy.

How ASNs are visible

Several public resources let you look up ASN information:

• whois -h whois.arin.net AS15169 (replace with the ASN).
• bgp.he.net (Hurricane Electric's public BGP toolkit).
• bgpview.io (web interface to public BGP data).
• PeeringDB (database where networks advertise their peering info).

These tell you:

• Who owns the ASN.
• What prefixes it announces.
• Who its peers are.
• Where it has presence (data center locations).

For someone diagnosing a routing issue, these are essential tools.

Single-homed vs multi-homed

A network can connect to the internet in different ways:

Single-homed: one upstream provider. The network buys transit from one ISP. All traffic flows through them.

Multi-homed: two or more upstream providers. Multiple paths to the internet. Better redundancy. Requires running BGP with each upstream.

Multi-homing is the main reason to have your own ASN. Without your own ASN, you can't run BGP independently with multiple providers.

Single-homed networks usually don't need an ASN; they can be a customer of one upstream and inherit its routing.

The "tier" hierarchy

ASes are informally categorized by their connectivity:

Tier 1: networks that have settlement-free peering with all other Tier 1s, reaching the entire internet without paying for transit. About a dozen worldwide. Examples: Lumen (CenturyLink/Level 3), Cogent, NTT, Telecom Italia Sparkle, GTT, Tata, Telia, Zayo (sometimes), Liberty Global.

Tier 2: networks that have some peering relationships but also buy transit from Tier 1s. Most large ISPs and content providers fit here.

Tier 3: networks that buy transit and don't peer broadly. Small ISPs, individual businesses.

These tiers aren't formal designations. They're community descriptions of operational connectivity. The lines are blurry: a network might be "Tier 2 but with extensive peering" and behave nearly like Tier 1 in some regions.

What ASes do operationally

A typical AS runs:

BGP routers at its edges, talking to neighboring ASes' routers. Announcing the AS's own prefixes; receiving announcements from others.

Internal routing protocols (OSPF, IS-IS, or proprietary equivalents) for moving traffic between routers inside the AS. iBGP for distributing external routes within.

Peering and transit contracts with other ASes. These are commercial arrangements that govern the BGP relationships.

Network operations centers (NOCs) that monitor and respond to incidents.

Customer support for whatever services they sell.

For a hosting company, the AS is the bedrock. Your customers don't see the ASN, but the quality of your AS's peering and operations directly determines how well their services perform.

The "AS path" concept

When BGP propagates routes, each AS that handles the announcement prepends its ASN to the path. The result is a list of ASes from the origin to the listener.

If you see a BGP route to 203.0.113.0/24 with AS path 64501 7018 32934, it means:

• The destination is in AS 32934.
• The route reaches you via AS 7018, which got it from AS 32934.
• You received the route from AS 64501, which got it from AS 7018.

This is how BGP detects loops: if a router sees its own ASN in the AS path of a received announcement, it rejects the announcement.

It's also how operators reason about paths: shorter AS paths are generally preferred (other things being equal).

AS reputation

ASes accumulate reputations:

• Stable, well-operated ASes (most major ones) are trusted by peers and customers.
• Misbehaving ASes (route hijacks, leaks, spam origins) get filtered or shunned.
• Brand-new ASes start with limited trust and earn it.

There are formal mechanisms (RPKI, route filtering, IRR records) and informal mechanisms (community knowledge, mailing list discussions). Together they shape which ASes can effectively reach the rest of the internet.

A new hosting company's ASN takes time to "earn its place." Peering arrangements have to be set up. Trust is built incrementally.

AS resilience patterns

Well-designed ASes have multiple geographic locations, multiple upstream providers, and diverse paths. A specific architecture might look like:

• Two or more data center locations.
• BGP peering in each location with diverse upstreams.
• Internal links between locations.
• Failover routing: if location A is unreachable, traffic flows through location B.

This is more complex than "one router, one upstream" but is the only way to deliver high availability at the network level.

A practical example

Suppose you're a small hosting company. You want to provide reliable service from your own infrastructure. Steps:

1. Obtain an ASN from your RIR. Modest fees, demonstrate need.
2. Obtain a small IP block (a /22 or /23) from the same RIR. Real money these days.
3. Set up servers in two data centers.
4. Establish BGP peering with each data center's upstream providers.
5. Announce your IP block via BGP from both locations.
6. The internet routes traffic to whichever location has the better path.

After this, your business has its own identity on the internet. Your customers connect to your IPs; the internet's routing finds your routers; your routers deliver traffic to the right server.

The barrier here is real but not enormous. A small hosting company with an in-house networking person can do this in months, not years.

What ASes are not

A few clarifications:

ASes are not legal entities. A single company can have many ASes. A single ASN can be operated by multiple legal entities (uncommon but possible).

ASes are not the same as service brands. Many CDN brands (e.g., Cloudflare) consist of one ASN; some have multiple. Some brands are virtual layers on top of others' ASNs.

ASes don't have to be ISPs. A large enterprise that runs its own internet-facing infrastructure can have an ASN without selling internet access to anyone.

Coming up

We've defined ASes. Next we need to understand BGP, the protocol that ASes use to tell each other about reachability. That's the next article, and the heart of how the internet's routing actually works.