Autonomous Systems - How the Internet Is Routed in Pieces
- An autonomous system (AS) is a set of IP prefixes run by one or more operators with a single, clearly defined routing policy (RFC 1930). It is an administrative unit, not a geographic one, and it is named by an ASN.
- Routing is two-level on purpose: an IGP (OSPF, IS-IS) finds paths inside one AS, and BGP between ASes carries reachability filtered by policy. Hierarchy buys scale, autonomy, and change isolation.
- An ASN is 16 bits or (since RFC 6793) 32 bits, handed out by the five regional registries. Some ranges are reserved: private use, documentation, and
AS_TRANS23456. - Every adjacent AS pair has a relationship (customer-provider or peer-peer). Export rules follow the money, and the resulting paths are valley-free: up, at most one peer link, down.
- The AS graph is not a tree: multi-homing and peering create cycles. That is why BGP carries the whole AS path, and why the export rules above are what keep routing stable.
Mental model
Think of countries and their postal services. Each country sorts mail internally however it likes: its own depots, its own rules, its own staff. That is the IGP. The countries only agree on a small treaty at the border: which kinds of mail they accept from whom, and at what rate. That is BGP. A parcel from Lisbon to Osaka is handled by a chain of national services, and no service needs to know how any other service organises its sorting floor.
Where it breaks: a country is a place and an AS is not. One company can hold several ASNs, one AS can span continents, and two ASes can serve the same street. Also, countries do not usually sell each other transit; ASes do, and those contracts decide which routes exist.
An AS is a company's network of microservices owned by one team. Inside the team boundary the service mesh, its discovery and its retries are private and can change daily. Only the published APIs cross the boundary, and the other team never sees your internals. The ASN is the team's name in the registry, the IGP is the internal mesh, and BGP is the contract-governed public API surface between teams.
Where it breaks: a team boundary is a convenience; an AS boundary is a commercial boundary. The neighbouring team can also be a competitor, can lie in its API responses, and nothing in the protocol proves it is allowed to publish what it publishes.
How it works
What the routing system needs
A router on the internet cannot hold the topology of every network. Every link change anywhere would force every router everywhere to recompute, and independent companies will not publish their internal topology or agree on one cost metric. So the internet splits the problem. The routing mechanics of the split are on Routing overview; this page owns the structure.
| Property | IGP (inside one AS) | EGP (between ASes, today BGP) |
|---|---|---|
| Scope | One operator's routers | Independent operators' border routers |
| Decides by | A metric such as link cost, the shortest path wins | Policy first (who pays whom), path length only as a tiebreak later |
| Knows | The full internal topology (link-state) or a view of it | Prefixes and the list of ASes each route crossed, never the other AS's internal links |
| Scale | One operator's network | The whole internet's prefix table; see the live counts below |
| Examples | OSPF, IS-IS, RIP, static routes | BGP; the original EGP of RFC 904 is long retired |
| Trust | One operator, one security domain | Neighbours are other companies and anyone can announce anything |
How big is the table? Do not trust a frozen number. The live prefix and AS counts are on Geoff Huston's BGP table statistics and the CIDR Report, and the AS-level graph with rank and customer cones is on CAIDA AS Rank.
The AS map
Five ASes with documentation ASNs (RFC 5398). Solid arrows point from customer to provider. The dashed link is a peering.
Money and trust are in the arrows; the transit-versus-peering business, tiers and IXPs are owned by ISPs, transit, peering and IXPs. Here we only need the routing consequence: who may hear which routes.
The life of a packet across four ASes
A home user at 198.51.100.23 in AS64496 opens a site whose server is 203.0.113.80 in AS64499 (both addresses are from the RFC 5737 documentation ranges). The path is made up, but its shape is what real paths look like.
Read the same journey at two levels. Every router decrements the IP TTL once, so the packet crosses 9 routers but only 4 ASes.
| Router | AS | Who decided the next hop | Route came from |
|---|---|---|---|
| R1, R2 | AS64496 | IGP inside AS64496 (for example OSPF): shortest path to the border router R3 | Internal topology |
| R3 | AS64496 | BGP: best route to 203.0.113.0/24 points at R4 in AS64497 | eBGP from R4, copied to R1 and R2 by iBGP |
| R4, R5 | AS64497 | IGP carries it from ingress R4 to egress R5, because BGP chose the neighbour behind R5 | iBGP plus the IGP route to the BGP next hop |
| R6, R7 | AS64498 | Same pattern: IGP to the exit border router | eBGP from R8's side |
| R8, R9 | AS64499 | IGP delivers to the server's subnet | The prefix is originated here by AS64499 |
Two things to take from it. The IGP never leaves its AS: R1 knows how to reach R3 but has no idea what is inside AS64497. And BGP does not carry hop-by-hop paths: the three-ASN list is everything AS64496 knows about the route. Session mechanics, NEXT_HOP and eBGP versus iBGP are on BGP and inter-AS routing.
Deep dive
Who gets an ASN
IANA allocates blocks of AS numbers to the five regional Internet registries (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC), and the registries assign them to organisations. The current allocation is the IANA AS Numbers registry. RFC 1930 gives the guidance for when an organisation needs one: it needs its own AS when it is multi-homed with a routing policy different from its providers'. A single-homed site normally lives inside its provider's AS and needs no ASN.
An ASN started as a 16-bit number and became 32 bits (RFC 4893, replaced by RFC 6793) because the 16-bit space ran short. A 32-bit ASN below 65536 is written exactly like a 16-bit one. A speaker that does not understand 4-byte ASNs sees the placeholder AS_TRANS (23456) in its place.
| Range | Meaning | Reference |
|---|---|---|
| 0 | Reserved, must not appear in routes | RFC 7607 |
| 1 to 64495 (except 23456) | Public 16-bit, assigned through the registries | IANA registry |
| 23456 | AS_TRANS, the 2-byte stand-in for a 4-byte ASN | RFC 6793 |
| 64496 to 64511 | Documentation and sample code | RFC 5398 |
| 64512 to 65534 | Private use (16-bit) | RFC 6996 |
| 65535 | Reserved (the last 16-bit ASN) | RFC 7300 |
| 65536 to 65551 | Documentation and sample code (32-bit) | RFC 5398 |
| 65552 to 131071 | Reserved by IANA | IANA registry |
| 131072 up to 4199999999 | Public 32-bit, allocated by the registries as needed | IANA registry |
| 4200000000 to 4294967294 | Private use (32-bit) | RFC 6996 |
| 4294967295 | Reserved (the last 32-bit ASN) | RFC 7300 |
The ranges are as listed by IANA on 2026-10-14. Check the registry, not this table, before depending on a boundary.
Stub, transit, multi-homed
- A stub AS originates its own prefixes and carries traffic only to or from itself. It does not re-export other ASes' routes to anyone. An enterprise or a campus is the common case.
- A transit AS carries traffic for other ASes between its neighbours. Providers are transit ASes.
- A multi-homed AS connects to two or more neighbours. It buys redundancy and the ability to steer traffic, but it also becomes a place where a policy mistake can turn it into an accidental transit path between its providers. The export rules below are the guard against that.
Default route versus full table
A stub can run on one default route toward its provider: it does not need the internet's table, only the provider's promise to deliver everything. A network with several providers, or one that is itself a transit provider, needs real choice and holds the full table in the default-free zone, the set of routers that run with no default route. The current table size is a live number (see the potaroo and CIDR Report links above). Table size is why forwarding hardware and the longest-prefix lookup on forwarding matter.
Hot potato and cold potato
When an AS has several exits toward a destination, it picks between them. Hot-potato routing hands the packet to the neighbour at the exit closest to where it entered, which offloads traffic from your network as fast as possible. Cold-potato routing carries it inside your network to the exit closest to the destination, spending your capacity to control the experience. The standard BGP tie-break behind hot potato is "lowest interior cost to the next hop" (RFC 4271, section 9.1.2.2): the IGP metric leaks into the choice of BGP exit.
Illustration (made-up numbers): a router in AS64497 has two otherwise equal routes to 203.0.113.0/24, one via exit X with IGP cost 10 and one via exit Y with IGP cost 40. Hot potato installs the route via X. Two consequences follow. The two directions of one conversation can take different paths (the return traffic is another AS's hot-potato choice), and an unrelated IGP cost change can move traffic from one neighbour to another. The full decision process and the knobs that override it are on BGP and inter-AS routing.
Relationships are routing policy
Each adjacent AS pair has a business relationship, summarised on ISPs, transit, peering and IXPs and inferred from public BGP data in Gao (2001). The routing view is a rule about what an AS exports (advertises) to each kind of neighbour, from Gao and Rexford (2001).
| Route was learned from | Export to customers | Export to peers | Export to providers |
|---|---|---|---|
| A customer (or originated here) | Yes | Yes | Yes |
| A peer | Yes | No | No |
| A provider | Yes | No | No |
The reason is money. Advertising a route invites traffic. Traffic to or from a customer earns revenue, so an AS tells everyone about its customers. Traffic that flows peer-to-peer or provider-to-provider earns nothing, and a route learned from a peer or provider that is re-advertised to another peer or provider would make the AS carry that traffic for free. The complementary preference rule is that an AS normally prefers a customer-learned route to a peer-learned one to a provider-learned one.
The consequence is a shape. Every AS path that obeys the rules is valley-free: it climbs customer-to-provider links, crosses at most one peer link, and then descends provider-to-customer links. Gao and Rexford show that if everyone follows these guidelines and no AS is its own provider through a chain of customer-provider links, BGP policy routing is stable without any global coordination.
The policy mechanics that implement this (local preference, communities, the full BGP decision process) and the incidents when it fails are on BGP and inter-AS routing. A hijack, the attack side of the same trust gap, is summarised on Network attacks.
Why the AS graph is not a tree
The first inter-AS protocol, EGP, assumed a tree: one core, with ASes hanging below it (RFC 904). The real graph has cycles because of two features. Multi-homing gives a customer two providers (AS64499 in the first figure). Peering adds links across the hierarchy that bypass the top. A tree has exactly one path between any two nodes, so you could route with a single default and no loop could form. A graph with cycles can form routing loops and has many paths, so BGP carries the whole AS path, letting a router spot its own ASN in it, and uses policy to pick one path among many. The same graph is what an anycast service is announced into from several places (Global traffic steering).
Organisation, AS and prefix are three different things
An organisation can hold several ASNs (after mergers, or to separate networks). An AS originates one or more prefixes. A prefix is announced by an AS, and the same prefix can have more than one origin AS (anycast, or a customer announced by two providers). When you debug, keep the three separate: the registry tells you who holds an ASN, BGP tells you which AS originates a prefix, and neither tells you who operates a specific IP.
Textbook vs real world
| The textbook says | Production does | Why |
|---|---|---|
| An AS is one ISP | A company can own several ASNs, and universities, enterprises, clouds and CDNs all have ASNs | An ASN names a routing policy, not a business type (RFC 1930) |
| An ASN identifies a country | The registry record names an organisation and a registry region; an AS can announce prefixes anywhere it has routers | Routing follows links and contracts, not borders |
| The AS-level path is the router-level path | The AS path hides every router inside each AS, and an IXP fabric does not appear as an AS hop | BGP exposes only AS hops; the IP path is longer and can differ per direction |
| Every AS runs OSPF inside | Others run IS-IS, static routes, or BGP-only fabrics | The IGP is the operator's choice and is invisible outside the AS |
| Private ASNs are only for labs | They are used deliberately inside data centres (RFC 7938) and stripped at the edge | A fabric needs thousands of ASNs and the private range avoids registry cost |
In production
- Large content and cloud networks have ASNs of their own. As of 2026-10-14 the Team Cymru lookup shows AS13335 as Cloudflare, AS15169 as Google and AS16509 as Amazon (see Hands-on for the command). Check any ASN at bgp.he.net or RIPEstat.
- Clouds originate customer prefixes. AWS lets a customer bring its own address space and announce it from AWS (BYOIP). BGP between a customer and a cloud is covered on Private connectivity.
- Data centre fabrics use private ASNs on purpose. RFC 7938 describes running eBGP inside a Clos fabric with private-use ASNs from 64512 to 65534: one ASN for all tier-1 devices, one per set of tier-2 devices in a cluster, and a unique ASN for every top-of-rack device. This is the legitimate home of private ASNs, and the RFC describes stripping them with the "remove private AS" feature when routes leave toward the outside.
- Anycast and CDNs ride on this graph. Which AS a user's route enters decides which site answers; see CDN and Global traffic steering.
History and evolution
- 1982 Early inter-network routing assumes a single core: RFC 827 specifies the Exterior Gateway Protocol (EGP) for exchanging reachability between a core and separately run systems.
- 1984 RFC 904 gives EGP its formal specification. What broke: EGP assumes a tree, and as networks interconnected freely that assumption failed.
- 1989 BGP is first specified in RFC 1105, then revised in RFC 1163 (1990) and RFC 1267 (1991). It carries paths, so loops are detectable on any topology.
- 1993 RFC 1519 introduces CIDR to slow routing-table growth and address exhaustion; aggregation keeps the inter-AS table smaller than the number of networks.
- 1994 BGP-4 (RFC 1654, then RFC 1771 in 1995) adds the prefix handling CIDR needs; RFC 4271 is the current BGP-4 specification (2006).
- 1996 RFC 1930 writes down the AS definition and when an organisation needs an ASN.
- 2007 What broke: the 16-bit ASN space ran short. RFC 4893 defines 4-byte ASNs, replaced in 2012 by RFC 6793.
- 2016 RFC 7938 documents eBGP as the routing protocol inside large data centres.
- Now The AS graph is measured continuously: CAIDA AS Rank, potaroo and the CIDR Report publish current sizes.
- Next Origin validation with RPKI is deployed and path validation (ASPA) is being standardised; both are covered with the policy side on BGP and inter-AS routing.
Hands-on
Map an IP address to its origin AS with Team Cymru's whois service. These outputs were captured on 2026-10-14 and abbreviated. Prefixes and allocation dates change over time.
The -v flag adds the prefix and registry columns. The leading space inside the quotes is required. The same data over DNS, handy in scripts:
Look up an ASN itself, including a documentation ASN, which has no registry entry:
RIPEstat has an HTTP API for the same question (output abbreviated to its data field):
To see the AS crossings along a path, ask traceroute to annotate hops: traceroute -A on Linux, traceroute -a on macOS. The output below is illustrative (documentation addresses and ASNs), not a capture:
Read the bracketed ASN column: each change of ASN is an inter-AS boundary. Traceroute shows the forward path only, a hop can be missing or wrongly mapped (the mapping comes from a database, and an IXP fabric address belongs to the IXP, not to either member), and the return path can be entirely different. More on traceroute itself is on traceroute.
Gotchas
Interview questions
Show answer
It is a set of IP prefixes run by one or more operators under a single, clearly defined routing policy, identified by an AS number. It is an administrative unit: routing inside it is the operator's own business, and it presents one coherent policy to its neighbours.
Follow-ups:
- Who assigns ASNs? IANA allocates blocks to the five regional registries (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC), which assign them to organisations.
- Does every network need one? No. A single-homed site normally sits inside its provider's AS; RFC 1930 says you need one when you are multi-homed with a policy of your own.
Show answer
An IGP runs inside one AS and finds the best path by a metric on a topology the operator controls (OSPF, IS-IS). An EGP runs between ASes and exchanges reachability under business policy (BGP today). They answer different questions: "what is the cheapest path in my network" versus "which neighbour do I trust to carry this traffic".
Follow-ups:
- Why not one protocol for everything? Scale, autonomy and trust: a flat protocol would flood every link change worldwide, and no operator will share its topology or accept a competitor's metric.
Show answer
Hierarchy contains scale, change and policy. Each AS summarises what is inside it to a few prefixes, so a link failure in one AS does not trigger recomputation everywhere, and each operator keeps its topology and policy private. Without it every router would hold every link and every flap would be global.
Follow-ups:
- How big is the table? It is a live number, see the CIDR Report and potaroo; aggregation (CIDR) is what keeps it smaller than the number of networks.
Show answer
Inside the source AS the IGP carries the packet to the border router that BGP chose. That border router hands it to the neighbouring AS over eBGP. The next AS's IGP carries it to its own exit border router, and so on until the origin AS delivers it to the destination subnet. The AS path is only the sequence of ASes, while each AS contributes several router hops.
Follow-ups:
- What is hot-potato routing? Exiting the AS at the closest border router to offload traffic quickly, which is why the IGP metric can influence the BGP exit.
Show answer
A stub originates its own prefixes and carries no one else's traffic. A transit AS carries traffic between its neighbours for money. A multi-homed AS has two or more neighbours for redundancy and traffic control, and may or may not be a transit.
Follow-ups:
- What changes in the BGP configuration when you multi-home? You need your own ASN and prefixes, and you must write export filters so you do not become a free transit between your providers.
Show answer
The AS hands traffic to the neighbour at the exit nearest to where it entered, using the IGP cost to the next hop as the tie-break (RFC 4271 section 9.1.2.2). It benefits the sender's network, because it spends the least of its own capacity, and often costs the receiver more. It also makes paths asymmetric, since each direction is decided by a different AS's choice.
Follow-ups:
- What is cold-potato? Carrying the traffic on your own backbone to the exit nearest the destination; a network that wants to control the experience, such as a content network, may choose it.
- What can go wrong operationally? An IGP cost change inside one AS can shift traffic between exits and neighbours without any BGP change.
Show answer
RFC 7938 uses eBGP between the layers of a Clos fabric and gives each top-of-rack device its own private ASN, so the fabric does not need public ASNs. They are stripped at the edge so that routes leave the network without them.
Follow-ups:
- What if they leak? They collide with other networks' private ASNs, break origin validation, and make routes impossible to attribute.
Show answer
Routes learned from a customer are exported to everyone; routes learned from a peer or provider are exported only to customers. Therefore every path is valley-free: up customer-to-provider links, at most one peer link, then down. If the customer-provider graph has no cycles, Gao and Rexford show this policy routing converges to a stable state without global coordination.
Follow-ups:
- What happens when an AS breaks the rule? It leaks routes and becomes accidental transit between networks that never agreed to it.
Fun facts
- AS23456 (
AS_TRANS) exists only as a stand-in so that a 2-byte-only BGP speaker can carry a 4-byte ASN (RFC 6793). - The first and last ASNs of each size are reserved: 0 (RFC 7607), 65535 and 4294967295 (RFC 7300).
- On 2026-10-14 the Team Cymru lookup listed AS1 as "LVLT-1 - Level 3 Parent, LLC", allocated 2001-09-20 by ARIN. That date is the registry record, not proof that it was the first AS ever used.
- Documentation ASNs have no holder at all: the same lookup returns
NO_NAMEfor AS64496.