How to Find an AS Number (ASN) for Any IP Address

Every public IP address on the internet belongs to an Autonomous System (AS) — a network operated by a single organization under a unique identifier called an AS Number (ASN). Looking up the ASN of an IP tells you who runs the network, which upstream providers they use, and how their routes are announced to the rest of the internet.

This guide covers every practical way to find the AS number of an IP address, the tools to use, and what the data actually means when you are debugging a network issue, investigating abuse, or auditing your upstream routing.

What Is an AS Number?

An ASN is a 16-bit or 32-bit integer assigned by a Regional Internet Registry (ARIN, RIPE, APNIC, LACNIC, AFRINIC) to identify a network on the global BGP routing table. Each ASN owns one or more IP prefixes and announces them to its BGP peers. Examples:

• AS15169 — Google
• AS13335 — Cloudflare
• AS16509 — Amazon AWS
• AS32934 — Meta / Facebook
• AS3356 — Lumen (formerly Level 3), a top-tier backbone

The range 64512–65534 (16-bit) and 4200000000–4294967294 (32-bit) are reserved for private use and are not routable on the public internet.

Why Look Up an ASN?

• Attribution — identify who operates a given IP (ISP, hosting provider, corporate network).
• Troubleshooting — when a traceroute shows latency or loss at a specific hop, the ASN reveals which network is responsible.
• Security and abuse — correlate abusive IPs to the upstream provider to send complaints to the right contact.
• Peering and transit audits — verify which providers your traffic actually transits before reaching its destination.
• Geolocation context — ASN ownership is often a better signal than geo-IP databases, which drift over time.

Command Line: whois

The quickest way to find the ASN of an IP from the terminal is via whois against a BGP-aware server. Cymru's whois service returns compact, parseable output:

whois -h whois.cymru.com " -v 8.8.8.8"

Output:

AS      | IP               | BGP Prefix          | CC | Registry | Allocated  | AS Name
15169   | 8.8.8.8          | 8.8.8.0/24          | US | arin     | 1992-12-01 | GOOGLE, US

For multiple IPs at once, feed them via stdin:

echo "begin
verbose
8.8.8.8
1.1.1.1
9.9.9.9
end" | whois -h whois.cymru.com

Standard RIR whois also works but returns verbose output:

whois -h whois.radb.net 8.8.8.8

Web Tools

For one-off lookups or richer context, web interfaces provide visualizations and historical data:

• bgp.he.net (Hurricane Electric) — enter any IP, prefix, or ASN. Shows announced prefixes, upstream peers, peer-to-peer relationships, and a searchable peering database. Best free tool for BGP inspection.
• RIPEstat — deep data on prefix history, routing announcements, anycast detection, and RPKI validation. Covers the full global routing table, not just RIPE region.
• PeeringDB — voluntary directory of ASN operators with contact info, peering policy, and IXP participation. Useful when you need to contact a network for operational issues.
• BGPView — clean UI with per-ASN upstream, downstream, IX, and prefix data. Also provides a free API.

Programmatic Lookup: APIs

Scripting ASN lookups is common for log enrichment, abuse correlation, or real-time monitoring. The simplest free endpoints:

# BGPView JSON API
curl -s https://api.bgpview.io/ip/8.8.8.8 | jq '.data.prefixes[0].asn'

# RIPEstat
curl -s "https://stat.ripe.net/data/network-info/data.json?resource=8.8.8.8" | jq '.data.asns'

# Team Cymru bulk whois via netcat
echo -e "begin\n8.8.8.8\nend" | nc whois.cymru.com 43

For high-volume pipelines, MaxMind GeoLite2-ASN is a free downloadable database you can query locally, avoiding rate limits.

Reading ASN Data

Beyond the AS number itself, lookups expose several related fields that matter when you analyze routing:

• AS name / organization — the human-readable operator (e.g., GOOGLE, CLOUDFLARENET).
• BGP prefix — the exact CIDR block containing the IP. A single ASN may announce dozens of prefixes.
• Country (CC) — the registration country of the prefix, not necessarily where the IP is physically used.
• Upstream providers — who the ASN buys transit from. Critical for debugging: if your traffic to AS15169 is slow, check which upstream it transits.
• Peers — ASNs that exchange traffic directly at internet exchanges. A well-peered ASN means shorter paths and better performance.
• RPKI validity — whether the prefix announcement is cryptographically signed. Invalid announcements may be dropped by strict networks.

Common Use Cases

• Debugging slow routes — resolve each traceroute hop to its ASN. A transition into a known congested transit provider often explains the latency spike.
• Reporting abuse — find the ASN, look up its abuse contact in PeeringDB or via whois, and send a report with logs.
• Geographic fraud detection — an IP claiming to be in one country while belonging to an ASN that operates only in another is a classic VPN/proxy signal.
• CDN footprint mapping — comparing which ASNs serve a given hostname from different vantage points reveals the CDN POP assignment.
• Auditing your own routes — verify that your traffic leaves through the transit provider you pay for, not a cheaper backup route.

ASN Lookup in TraceMapper

Manually resolving each hop of a traceroute to its ASN is tedious. TraceMapper automates this: every hop in a trace is enriched with the owning ASN, operator name, and country, so you can visually follow your traffic as it crosses from one network to another. When a performance issue appears at a specific hop, the ASN is already on screen — no need to switch between tools.

Key Takeaways

• Every public IP belongs to an ASN — a 16- or 32-bit number identifying the network operator in the BGP routing table.
• For quick lookups, use whois -h whois.cymru.com or web tools like bgp.he.net and RIPEstat.
• For scripting, BGPView, RIPEstat, and Team Cymru expose free APIs; MaxMind GeoLite2-ASN is the go-to local database.
• Beyond the AS number, look at upstream providers, peers, and announced prefixes to understand routing behavior.
• Combine ASN lookup with a traceroute to map the full network path and pinpoint where performance issues originate.