ASN

osint

ASN

Definition

An Autonomous System Number (ASN) is a globally unique identifier assigned by Regional Internet Registries (RIRs) to a network or group of networks that operates under a single administrative policy. ASNs are fundamental to Border Gateway Protocol (BGP) routing, which governs how traffic flows between networks on the internet. In OSINT and cybersecurity, ASN data provides critical intelligence: mapping IP addresses to their owning organizations, identifying hosting infrastructure, detecting network relationships, and attributing malicious activity to specific network operators.

In the Prismatic Platform, ASN lookup and analysis is integrated into the OSINT toolbox and Perimeter EASM system for infrastructure discovery, attribution, and attack surface mapping.

Technical Deep Dive

ASN Structure

FormatRangeDescription
2-byte ASN1 - 65534Original format, mostly exhausted
4-byte ASN65536 - 4294967294Extended format (ASN.1 notation: X.Y)
Private ASN64512 - 65534, 4200000000 - 4294967294Internal use only
Reserved0, 65535Protocol use

ASN Intelligence Value

Intelligence UseDescriptionPlatform Integration
IP AttributionMap IP → OrganizationPerimeter asset discovery
Infrastructure MappingIdentify hosting providersOSINT tool enrichment
Peering AnalysisNetwork relationship graphDD entity enrichment
Threat AttributionLink attacks to networksBlue Team defense
GeolocationCountry/region of networkCompliance assessment

Data Sources

SourceTypeCoverage
RIPE NCCRIR (Europe, Middle East)Full EMEA
ARINRIR (North America)Full NA
APNICRIR (Asia Pacific)Full APAC
Team CymruIP-to-ASN mappingGlobal
BGPStreamReal-time BGP dataGlobal

Architecture and Implementation

defmodule PrismaticOsintCore.ASNLookup do
  @moduledoc """
  ASN lookup and enrichment for OSINT intelligence gathering.
  Resolves IP addresses to ASN ownership data using multiple
  data sources with caching for performance.
  """

  @type asn_info :: %{
          asn: pos_integer(),
          name: String.t(),
          description: String.t(),
          country: String.t(),
          rir: String.t(),
          prefixes: [String.t()],
          peers: [pos_integer()]
        }

  @spec lookup_ip(String.t()) :: {:ok, asn_info()} | {:error, term()}
  def lookup_ip(ip_address) do
    case check_cache(ip_address) do
      {:ok, cached} -> {:ok, cached}
      {:error, :not_found} -> fetch_and_cache(ip_address)
    end
  end

  @spec lookup_asn(pos_integer()) :: {:ok, asn_info()} | {:error, term()}
  def lookup_asn(asn_number) do
    with {:ok, raw} <- query_rir(asn_number),
         info <- normalize_asn_data(raw) do
      cache_result(asn_number, info)
      {:ok, info}
    end
  end

  @spec get_prefixes(pos_integer()) :: {:ok, [String.t()]}
  def get_prefixes(asn_number) do
    case lookup_asn(asn_number) do
      {:ok, %{prefixes: prefixes}} -> {:ok, prefixes}
      error -> error
    end
  end

  @spec fetch_and_cache(String.t()) :: {:ok, asn_info()} | {:error, term()}
  defp fetch_and_cache(ip_address) do
    with {:ok, raw} <- query_team_cymru(ip_address),
         info <- normalize_asn_data(raw) do
      cache_result(ip_address, info)

      :telemetry.execute(
        [:prismatic, :osint, :asn, :lookup],
        %{count: 1},
        %{ip: ip_address, asn: info.asn}
      )

      {:ok, info}
    end
  end
end

Usage in Prismatic Platform

  • Perimeter EASM: ASN mapping for discovered assets to identify hosting infrastructure and network ownership
  • OSINT Toolbox: ASN enrichment integrated into Shodan, Censys, and network analysis adapters
  • DD Pipeline: Entity enrichment with network infrastructure ownership data
  • Blue Team Defense: ASN-based traffic analysis for detecting anomalous network connections
  • Compliance Assessment: Verifying data residency through ASN geolocation data

Code Examples

ASN-Based Asset Enrichment

defmodule PrismaticPerimeter.ASNEnricher do
  @moduledoc """
  Enriches discovered assets with ASN ownership information
  for infrastructure attribution in the Perimeter EASM system.
  """

  alias PrismaticOsintCore.ASNLookup

  @spec enrich_assets([map()]) :: {:ok, [map()]}
  def enrich_assets(assets) do
    enriched = Enum.map(assets, fn asset ->
      case ASNLookup.lookup_ip(asset.ip_address) do
        {:ok, asn_info} ->
          Map.merge(asset, %{
            asn: asn_info.asn,
            asn_name: asn_info.name,
            asn_country: asn_info.country,
            hosting_provider: asn_info.description
          })
        {:error, _} -> asset
      end
    end)

    {:ok, enriched}
  end
end

Best Practices

  1. Cache ASN lookups aggressively: ASN-to-organization mappings change infrequently. Cache for 24-72 hours.
  2. Use multiple data sources: Cross-reference RIR data with Team Cymru and BGPStream for accuracy.
  3. Track ASN changes over time: ASN ownership changes can indicate infrastructure transfers relevant to intelligence.
  4. Handle private ASNs correctly: Filter out private ASN ranges from analysis results.
  5. Monitor BGP announcements: Real-time BGP monitoring detects route hijacking and prefix manipulation.
  • Advisory -- security advisories affecting specific ASN ranges
  • Correlation -- relating ASN data across intelligence sources
  • Anomaly Detection -- detecting anomalous BGP announcements
  • Containment -- network-level containment by ASN

See Also

Connect & Contribute

Created by Tomas Korcak (korczis) | Open Source under GHL

Back to Glossary