An autonomous system (AS) is a network, or a collection of networks, that presents a single routing policy to the rest of the internet and is identified by a unique autonomous system number (ASN). The internet is roughly 80,000 of these independently run blocks, operated by broadband providers, mobile carriers, cloud companies, universities and large businesses. Each one tells its neighbours which ranges of IP addresses it can deliver traffic to. The arrangement exists so that no single operator has to know the internal layout of every other network: routers only need to know which AS to hand a packet to next.

For advertisers, the ASN is one of the most frequently used, and least discussed, signals in the fight against fake traffic. A click from a hosting company's ASN is far more likely to come from a server than a person.

How routing between autonomous systems works

The protocol that connects autonomous systems is the Border Gateway Protocol (BGP), currently version 4, specified in RFC 4271 in January 2006. Each AS announces the IP prefixes, or address ranges, it originates. A prefix such as 216.73.216.0/22 covers 1,024 consecutive IPv4 addresses. Neighbouring networks pass these announcements onward, each adding its own number to a list called the AS path. Routers generally prefer the shorter path, subject to their operators' commercial policies.

Those policies are where the "autonomous" in the name comes from. RFC 1930, published in March 1996 by John Hawkinson of BBN Planet and Tony Bates of MCI, defines an AS as "a connected group of one or more IP prefixes run by one or more network operators which has a SINGLE and CLEARLY DEFINED routing policy." At its border, an AS decides which routes to accept, which to advertise and to whom.

Relationships between autonomous systems fall into two broad commercial types. In transit, a smaller network pays a larger one to carry its traffic to the rest of the internet. In peering, two networks exchange traffic destined for each other's customers, often without payment. The PPC Land explainer on content delivery networks describes how Cloudflare uses anycast, announcing the same addresses from many locations and letting BGP carry each request to the nearest site with capacity.

Not every organisation needs its own number. RFC 1930 says a site connected to more than one provider, known as multi-homed, is "ALMOST THE ONLY case" that justifies a dedicated AS. A single-homed business typically uses addresses announced by its provider's AS.

Numbers, registries and allocation

ASNs are handed out through the same hierarchy that distributes IP addresses. The Internet Assigned Numbers Authority (IANA) allocates blocks of numbers to the five regional internet registries (RIRs): AFRINIC for Africa, APNIC for Asia-Pacific, ARIN for North America, LACNIC for Latin America and the Caribbean, and the RIPE NCC for Europe, the Middle East and parts of Central Asia. The registries assign individual numbers to network operators.

The original numbers were 16-bit, allowing 65,536 values. The 32-bit extension raised the ceiling to roughly 4.29 billion. IANA's registry, last updated on June 1, 2026, reserves several ranges: 0 is never used, 23456 is a placeholder called AS_TRANS that lets older 16-bit routers handle newer 32-bit numbers, 64496 to 64511 are kept for documentation, and 64512 to 65534 and 4200000000 to 4294967294 are for private use inside networks, never to be announced publicly.

Large companies are often identified by their numbers in traffic analysis. Amazon operates AS16509 and AS14618, Microsoft AS8075, Google AS15169, Google Cloud AS396982, Cloudflare AS13335 and Meta AS32934. As of October 12, 2026, the routing table monitored by APNIC researcher Geoff Huston's potaroo.net service showed 79,584 autonomous systems, of which 68,015 only originated their own routes and carried no transit traffic for others.

Origin and evolution

The term predates BGP. In October 1982, Eric Rosen of Bolt Beranek and Newman described in RFC 827 how the internet was evolving into "domains or 'autonomous systems'", each a group of relatively homogeneous gateways, and gave them "16-bit identification numbers". That document specified the Exterior Gateway Protocol (EGP), which assumed a tree-shaped network with a single core.

As the network grew into a mesh, EGP struggled. Kirk Lougheed and Yakov Rekhter published BGP in RFC 1105 in June 1989. BGP-4, which added classless addressing so that prefixes of any length could be announced, arrived in RFC 1771 in March 1995 and was revised as RFC 4271 in 2006.

Number exhaustion forced the next change. The 32-bit format was standardised in RFC 4893 in May 2007, later replaced by RFC 6793 in December 2012. The RIPE NCC's policy, accepted on September 18, 2006, phased the change in: from January 1, 2007 registries issued 32-bit numbers on request, from January 1, 2009 they became the default, and from January 1, 2010 the two pools merged.

Security came last. BGP was designed on trust, and any AS can announce any prefix. On February 24, 2008, Pakistan Telecom's AS17557 announced a more specific route for YouTube's addresses while trying to block the site domestically, and the announcement spread worldwide, taking YouTube offline for about two hours. Resource Public Key Infrastructure (RPKI), described in RFC 6480 in February 2012, lets address holders sign records stating which ASN may originate their prefixes, so that other networks can reject invalid announcements.

Why it matters to the marketing community

ASNs sit beneath several measurement and fraud controls. The Media Rating Council's Invalid Traffic Detection and Filtration Guidelines, finalised on October 27, 2015 and updated on June 25, 2020, treat data centre traffic as a category of general invalid traffic (GIVT). The PPC Land explainer on invalid traffic notes that the MRC requires filtration of traffic from the three largest hosting entities, Amazon AWS, Google and Microsoft, and that the Trustworthy Accountability Group maintains a shared data centre address list. In practice, many such lists are built by mapping addresses to the ASNs that announce them.

The bid request itself does not carry an ASN. The OpenRTB 2.6 specification from IAB Tech Lab includes fields for the device's IPv4 and IPv6 addresses and a "carrier" string naming the ISP, but no AS field. Buyers and verification vendors derive the network by looking the address up against BGP data or commercial IP databases. That is why Google's June 2026 decision to let AdSense publishers share the full IP address in bid requests mattered for invalid traffic detection: a truncated address weakens lookups.

Concentration makes the signal useful. Cloudflare's 2025 year-in-review data showed that Amazon's AS16509 generated 9.2% of global bot traffic, followed by Microsoft's AS8075 at 5.5%. Decodo found that bot origin follows cloud infrastructure rather than population, with the United States accounting for 53.5% of bot traffic.

Crawler verification relies on the same layer. Meta directs site operators to confirm that requests claiming to come from its crawler originate in autonomous system 32934, rather than publishing a list of addresses. Other operators publish prefix files instead: Google moved its crawler IP range files to a daily refresh, and Apple added 4,656 addresses to Applebot in a single update.

Limitations and disputes

An ASN identifies a network operator, not a person or a company. Most businesses do not run their own AS, so their traffic appears under their provider's number, which limits B2B targeting by network. Cloud ASNs also carry legitimate traffic from corporate VPNs and privacy relays alongside bots.

Fraud has moved to evade the signal. A residential proxy routes automated traffic through consumer devices, so requests arrive from ISP networks rather than data centres, while data centre proxies are "trivially classified by its autonomous system". When a Shopify merchant faced a bot flood in April 2026, ASN blocking through Cloudflare failed alongside challenge pages and premium bot apps. In August 2026, GreyNoise found scanners posing as ClaudeBot from 824 addresses spread across 795 separate /24 networks, leaving no single block to filter.

Faktica Analytics showed in April 2026 that Google Ads IP exclusions can be bypassed by splitting a click between two addresses. A Stanford study found that 5% of client addresses send 55% of web requests, and its authors could not identify the ASNs involved because Cloudflare's data was proprietary.

Routing security remains incomplete. The share of RPKI-valid IPv4 routes reached 53.9% by the end of 2025, according to Cloudflare, leaving much of the table unprotected. And because BGP announcements can be withdrawn, an AS can vanish. On October 4, 2021, Facebook's networks withdrew routes during maintenance, taking its services offline for about six hours.

Not the same as

IP address. An address identifies one endpoint. An AS announces many prefixes, often millions of addresses, under one policy.

ISP. An internet service provider is a business. Most ISPs operate one or more ASes, but many ASes belong to cloud companies, universities or enterprises that sell no internet access.

CDN. A content delivery network is a service that caches content close to users. CDNs run their own ASes.

Cloudflare Radar. Cloudflare's public data platform reports traffic and bot shares broken down by AS. It is a source of AS-level statistics, not a routing concept.

Autonomous systems in AI and robotics. Self-driving vehicles and AI agents are also called autonomous systems. The phrase is unrelated to routing.

Recent developments

On January 8, 2026, Iranian operators including TCI (AS58224) and IranCell (AS44244) withdrew BGP announcements, removing about 98.5% of the country's announced IPv6 space. Escrow.com reported a blended IPv4 price of $21.35 per address in the second quarter of 2026. With fraud migrating to residential networks, ASNs remain a first filter rather than a final answer.

Timeline

  • October 1982 - RFC 827, by Eric Rosen, introduces "autonomous systems" with 16-bit identification numbers in the Exterior Gateway Protocol.
  • June 1989 - RFC 1105 publishes the first version of BGP.
  • March 1995 - RFC 1771 specifies BGP-4 with classless addressing.
  • March 1996 - RFC 1930 defines an AS and sets guidelines for when an operator should register one.
  • January 2006 - RFC 4271 revises the BGP-4 specification.
  • September 18, 2006 - RIPE NCC accepts its 4-byte AS number policy.
  • January 1, 2007 - Registries begin issuing 32-bit ASNs on request.
  • May 2007 - RFC 4893 standardises 32-bit AS numbers.
  • February 24, 2008 - Pakistan Telecom's AS17557 hijacks YouTube's prefixes.
  • January 1, 2009 - 32-bit ASNs become the default assignment.
  • January 1, 2010 - Registries stop distinguishing 16-bit and 32-bit pools.
  • February 2012 - RFC 6480 describes RPKI for routing security.
  • December 2012 - RFC 6793 replaces RFC 4893.
  • October 27, 2015 - MRC finalises Invalid Traffic Detection and Filtration Guidelines 1.0.
  • June 25, 2020 - MRC finalises IVT guidelines 2.0.
  • October 4, 2021 - Facebook route withdrawal causes a global outage.
  • January 8, 2026 - Iranian networks withdraw BGP announcements in a national shutdown.
  • October 12, 2026 - potaroo.net counts 79,584 autonomous systems in the routing table.

Summary

Who: Network operators, including ISPs, mobile carriers, cloud providers, CDNs, universities and large enterprises, run autonomous systems; IANA and the five regional internet registries assign their numbers; verification vendors, ad platforms and publishers use ASNs to classify traffic.

What: A network or group of IP prefixes under a single, clearly defined routing policy, identified by a 16-bit or 32-bit autonomous system number and connected to others through BGP.

When: The term appeared in RFC 827 in October 1982, was formally defined in RFC 1930 in March 1996 and moved to 32-bit numbering between 2007 and 2010.

Where: At the borders between networks across the global internet, and in ad tech within invalid traffic filters, crawler verification and bot detection systems.

Why: Autonomous systems let independent networks exchange routes without sharing their internal layouts, and their numbers give advertisers a coarse but widely used way to separate data centre traffic from human visits.