{{ summaryTitle }}
{{ summaryValue }}

{{ summaryLine }}

{{ badge.label }}: {{ badge.value }}
Use one value such as AS15169, 15169, 8.8.8.8, or 2001:4860:4860::8888.
This helper contacts a public IP-detection service only after you select it.
The neutral default is 0 for all returned prefixes; accepted range is 0–500 rows.
rows
Provider order is neutral; sorting changes only the visible ledger and its exports.
All observations is neutral; the filter changes only the visible neighbour ledger and its exports.
Off is neutral and avoids the additional provider request. PeeringDB fields are self-published context.
{{ includePeeringdbEnabled ? 'On' : 'Off' }}
The neutral default is 9000 ms; accepted range is 3000–15000 ms.
ms
FieldValueEvidenceCopy
{{ row.label }}{{ row.value }}{{ row.source }}
PrefixFamilyCopy
{{ row.prefix }}{{ row.family }}
ASNNameObservationCopy
{{ row.asn }}{{ row.name }}{{ row.type }}
  1. {{ item.title }}{{ item.detail }}

RIPE RIS neighbours describe observed AS-path position. Registry and PeeringDB records are supporting evidence and can change independently.

BGP Prefix List Generator Turn IPv4 and IPv6 CIDR rows into platform-specific prefix-list syntax, with normalized networks and ordered-policy warnings.
Static Route Commands Generator Generate reviewed static-route commands across host and network CLIs with CIDR normalization plus priority checks and rollback-ready delete output.
EDNS Client Subnet (ECS) Tester Compare DNS answers with and without an EDNS Client Subnet hint, then inspect answer steering, echoed scope, TTL drift, and privacy clues.
IP Overlap Checker Check IPv4 CIDRs and ranges for exact duplicates, containment, partial overlap, host-bit corrections, and duplicate address coverage.

A public IP address in a firewall log identifies an endpoint, but the surrounding routing system often explains more. The address belongs to a routed prefix, that prefix is announced by an autonomous system, and the autonomous system is identified by an Autonomous System Number (ASN). Incident response, allowlist review, route troubleshooting, abuse handling, and peering research all use that number as a common starting point.

An autonomous system is a network or group of networks that presents a routing policy to the wider Internet through the Border Gateway Protocol (BGP). One organization may operate several ASNs, while one ASN may announce many IPv4 and IPv6 prefixes. The holder name therefore does not describe every service, customer, or address behind the ASN.

Evidence What it describes Important limit
Routing observationPrefixes and AS-path neighbours visible to route collectors.Visibility varies by collector and time; path position does not prove a contract.
Registration recordThe registry object, handle, organization, and contact roles for the number resource.Registration is not proof that a route is active or that a contact owns a specific event.
Peering profileOperator-published network name, policy, and declared capacity.The operator maintains the data, so it can be incomplete or stale.

A neighbouring ASN seen to the left or right of a target in an AS path is an observation about path order. It may reflect transit, peering, a route server, collection bias, or another routing arrangement. Commercial roles need corroboration from contracts, operator statements, or several independent routing views.

ASN evidence is a time-stamped snapshot. Prefix announcements, registry contacts, and self-published peering data can change independently, so a current lookup should accompany any high-impact network or abuse decision.

How to Use This Tool:

Use one ASN when you already know the routing identity, or one public IP address when you need its currently returned origin ASN first.

  1. Enter a value such as AS15169, 15169, 8.8.8.8, or a public IPv6 address. Private IPv4, loopback, link-local, IPv6 unique-local, and malformed values are rejected.
  2. Select Lookup ASN. An IP input is resolved to an origin ASN before routing and registration evidence is requested.
  3. Confirm the returned ASN and holder, then compare the announced-prefix and path-neighbour counts. A holder match alone is not enough when the decision concerns a specific prefix or route.
  4. Use Visible prefix limit, Prefix order, and Neighbour observation only to narrow the displayed ledgers. These controls do not change the underlying provider lookup.
  5. Enable PeeringDB context only when operator-published peering information is useful. Increase the timeout within 3,000 to 15,000 ms only when a provider is slow.

Interpreting Results:

Read the ASN and holder as network identity evidence, the prefix list as current route-collector evidence, and the RDAP fields as registry evidence. These sources answer different questions and may update at different times.

  • An empty or short prefix list does not prove that the ASN is inactive; the selected public view may have limited or changing visibility.
  • A neighbour marked left, right, or uncertain records its AS-path position. Do not translate that label directly into customer, provider, or peer.
  • An RDAP abuse address is a registry contact clue. Match the ASN, affected prefix, event time, and relevant policy before using it.
  • A missing PeeringDB result means no matching optional record was returned, not that the network has no peering policy.

Technical Details:

ASNs are normalized to the form AS followed by an integer from 1 through 4,294,967,295. A public IP input first produces an origin-ASN candidate from current network information. That resolved ASN becomes the key used across routing, registration, and optional peering sources.

Lookup Core

The result combines independent public records rather than treating one provider as a complete authority.

Source Evidence retained Normalization rule
RIPEstat AS overviewHolder, country code, routing status, first-seen, and last-updated fields.Missing fields remain explicitly unavailable rather than being inferred.
RIPEstat announced prefixesDistinct IPv4 and IPv6 prefixes.Duplicate prefix text is removed; at most 5,000 normalized rows are retained.
RIPE RIS peer evidenceObserved upstream and downstream counts plus neighbour ASN, name, and path position.Neighbour rows are unique by ASN and position and are capped at 5,000 rows.
Regional Internet Registry RDAPAutonomous-system handle, name, and abuse-role email fields.Regional registries are tried until the first usable autonomous-system record is returned.
PeeringDB, when enabledNetwork name, general peering policy, and declared IPv4 plus IPv6 prefix capacity.Returned data is labeled as operator-authored context.

The display limit accepts 0 through 500 rows, where 0 means every normalized prefix. Provider order is preserved unless length or address-text sorting is selected. These display choices do not alter the canonical prefix count.

Formula Core

The evidence profile reports completeness within each declared category. It measures returned fields, not the truth or quality of those fields.

C= nreturnedndeclared ×100%

Identity completeness uses five fields, routing completeness uses the presence of two evidence groups, RDAP completeness uses three fields, and PeeringDB completeness uses three fields. A category can show 100% while its information is stale, self-published, or irrelevant to the incident under review.

Accuracy and Privacy Notes:

This lookup sends the submitted ASN or public IP to external network-data services. The optional current-IP action first contacts a public IP-detection service, then uses the returned address for the ASN lookup.

  • RIPEstat receives the resolved ASN, and an IP input is also sent for origin-ASN resolution.
  • Regional Internet Registry RDAP services receive the ASN while the lookup searches for a usable registration record.
  • PeeringDB receives the ASN only when PeeringDB context is enabled.
  • Provider timeouts or partial fields reduce the available evidence. Re-run the lookup and corroborate critical conclusions with an authoritative registry or a second routing view.

References: