An autonomous system (AS) is a collection of IP networks under the control of one or more operators that present a single, clearly defined routing policy to the rest of the Internet. Each autonomous system is identified by a globally unique autonomous system number (ASN) and exchanges reachability information with its neighbors through the Border Gateway Protocol (BGP).
Among Internet fundamentals, the autonomous system is the basic unit of interdomain routing. The Internet is not one network but tens of thousands of autonomous systems, operated by ISPs, cloud providers, content networks, universities and large enterprises, which agree to carry traffic for each other according to their own policies.
How an autonomous system routes traffic
Routing on the Internet works at two levels. Inside an autonomous system, an interior gateway protocol such as OSPF or IS-IS computes the best paths between the operator’s own routers, optimizing for link cost or latency. Between autonomous systems, external BGP (eBGP) carries announcements of IP prefixes and the AS path that leads to them.
BGP is a path-vector protocol. Each route carries the list of ASNs it has traversed, which prevents loops and lets each operator apply policy. Route selection depends first on local preference set by business policy, and only then on attributes such as AS path length, origin and multi-exit discriminator. The result is that Internet paths reflect commercial relationships at least as much as geography.
| Aspect | Inside an AS | Between autonomous systems |
|---|---|---|
| Protocols | OSPF, IS-IS, internal BGP | External BGP |
| Goal | Efficient paths across own network | Policy-controlled reachability |
| Trust model | One operator, full trust | Independent parties, limited trust |
| Path metric | Link cost, bandwidth, latency | Policy, then AS path length |
| Scale | Hundreds to thousands of routes | Around a million IPv4 and IPv6 prefixes |
AS numbers and their allocation
ASNs are assigned by IANA to the five Regional Internet Registries, namely AFRINIC, APNIC, ARIN, LACNIC and RIPE NCC, which allocate them to organizations. An applicant generally needs its own address space or a plan to connect to at least two upstream networks, since a single-homed network can simply use its provider’s ASN.
The original 16-bit number space held only 65,536 values and approached exhaustion, so 32-bit ASNs were standardized and are now the default for new allocations. Some ranges are reserved for private use, similar to private IP address space.
| Range | Type | Use |
|---|---|---|
| 1 to 64495 | 16-bit public | Globally routed networks |
| 64512 to 65534 | 16-bit private | Internal BGP designs, not announced publicly |
| 65536 to 4199999999 | 32-bit public | Current public allocations |
| 4200000000 to 4294967294 | 32-bit private | Large private deployments, data centers |
| 0, 23456, 65535 | Reserved | Special protocol meanings |
Types of autonomous systems and their relationships
Autonomous systems are commonly classified by how they connect and whether they carry traffic for others. A stub AS connects to one provider, a multihomed AS connects to several providers for resilience but does not offer transit, and a transit AS carries traffic between other networks.
Relationships between autonomous systems fall into two main commercial models. In transit, a customer pays a provider for reachability to the whole Internet. In peering, two networks exchange traffic between their own customers, often without payment, either over a private link or at an Internet exchange point.
| Relationship | Routes exchanged | Typical commercial terms |
|---|---|---|
| Customer to provider | Provider announces the full table | Customer pays for transit |
| Settlement-free peering | Each side announces its own and customer routes | No payment, balanced traffic |
| Paid peering | As in peering, but traffic is unbalanced | One side pays |
| Route server at an IXP | Many peers through one session | Exchange membership fee |
Autonomous system compared with related terms
The autonomous system is often confused with organizations or physical infrastructure. It is a routing identity, not a company, a cable or a building.
- ISP: a business that sells connectivity; a large ISP may operate one or several autonomous systems.
- Internet backbone: the high-capacity links of the largest transit autonomous systems, sometimes called Tier 1 networks.
- Internet exchange point: a shared switching fabric where many autonomous systems peer.
- TCP/IP suite: the protocol family that defines packets and addresses; BGP runs on top of TCP port 179.
Autonomous systems are also visible in everyday network diagnostics. Traceroute tools can annotate each hop with its ASN, and public routing data shows which ASN originates a prefix and through which paths it is reachable. Large content and DNS operators use anycast, announcing the same prefix from many locations under one ASN, so BGP delivers each user to the topologically nearest site. This technique depends entirely on the routing policies of the autonomous systems in between.
Risks, security and operational pitfalls
BGP was designed on implicit trust between autonomous systems, so any AS can announce any prefix. Misconfigurations and malicious announcements cause route leaks and prefix hijacks that can redirect or blackhole traffic for large parts of the Internet within minutes.
The main defense today is RPKI with route origin validation, which lets prefix holders publish signed statements about which ASN may originate their routes, so other networks can reject invalid announcements. Operators also apply strict prefix filters on customer sessions and follow industry norms such as the MANRS actions. Path validation beyond the origin, for example with ASPA, is still being deployed.
Stripped to the essentials
The Internet is made of many separate networks owned by different organizations. Each of those networks is an autonomous system, and each has its own number, like a country code for routing.
These networks constantly tell their neighbors which addresses they can reach. Data finds its way across the world by passing from one autonomous system to the next, following agreements about who carries whose traffic.
Where it is applied
A mid-sized online retailer depends on a single ISP. When that provider has an outage, the shop disappears from the Internet for several hours. The company decides to become its own autonomous system.
It obtains a 32-bit ASN and an IPv6 block from its Regional Internet Registry, acquires a small IPv4 range, and connects its data center routers to two different transit providers using eBGP. It creates RPKI route origin authorizations for its prefixes and announces them to both providers.
Months later, one provider suffers a fiber cut. BGP withdraws the affected routes, and traffic shifts to the second provider within a minute or two. Customers notice at most a brief slowdown, and the shop stays online.