What is BGP ASN?

Understanding BGP ASN

A BGP ASN (Border Gateway Protocol Autonomous System Number) is a globally unique number that identifies an autonomous system (AS) — a network or group of networks under one administrative routing policy — so it can advertise and exchange routes via BGP across the internet. ASNs come in 16-bit (1–65535) and 32-bit (per RFC 6793) forms.

Regional Internet Registries (ARIN, RIPE NCC, APNIC, etc.) assign ASNs to organizations that run their own routing policy. Public ASNs are used to peer over external BGP (eBGP) with other autonomous systems, while private ASNs (64512–65534 and 4200000000–4294967294) are used internally. A router announces prefixes tagged with its origin ASN, and the AS-PATH attribute records each ASN a route traverses, enabling loop prevention and policy decisions.

For security, ASNs are the trust unit of internet routing. Because classic BGP accepts advertisements without verifying that the originating AS legitimately holds a prefix, attackers can perform prefix hijacking or AS-path manipulation to reroute or blackhole traffic. Mitigations bind prefixes to authorized ASNs: RPKI Route Origin Authorizations (ROAs) cryptographically state which ASN may originate a prefix, and Route Origin Validation lets routers drop invalid announcements. Monitoring AS-PATH changes also surfaces leaks and hijacks.

For example, in the 2008 Pakistan Telecom incident, AS17557 originated a more-specific YouTube prefix, and because peers accepted the bogus origin ASN, global traffic to YouTube was redirected and dropped. Today an operator publishing a valid ROA tying its prefix to its correct ASN would let RPKI-validating networks reject such a false origin, illustrating why the ASN-to-prefix binding is central to routing security.