Reading BGP AS paths to understand where an IP really comes from
AS numbers, AS paths and upstreams — how to read routing data with public tools, and why the announcing ASN decides the verdict.
The two identifiers that matter
Every public IPv4 address belongs to a prefix, and every prefix is announced by an AS (autonomous system) with a number. Two different things are often confused:
- Who owns the address block (registered in RDAP).
- Who announces it right now (visible in BGP).
They are usually the same, but not always — transfers, leasing and resold space all create gaps. For a store-safety check, the announcing ASN matters more, because that is what platforms and blacklists see.
Reading an AS path
traceroute shows you the path your packets take; an AS path shows the path announcements take. Use a looking glass:
# RIPEstat
https://stat.ripe.net/data/prefix-overview/data.json?resource=45.32.11.8
# bgp.tools / bgp.he.net — paste the IP and read "Origin AS"You will get something like AS20473 (Vultr) or AS7922 (Comcast). The origin AS is the one that announces the prefix; upstreams in the path just carry it.
Why "upstream" is not the answer
A sales page may say "our IPs are announced through a tier-1 carrier". True for almost every network — including datacenters. Upstream transit says nothing about who uses the line. What matters is the origin AS type: hosting, CDN or consumer ISP.
A quick command-line check
Team Cymru's whois service maps an IP to its ASN and prefix:
whois -h whois.cymru.com " -v 45.32.11.8"Output gives the AS number, the announced prefix, the country and the AS name. If the name looks like a cloud provider, you are done before you finish reading.
What to remember
- Ownership and announcement are different questions.
- Announcement wins for risk checks: platforms see routes, not registries.
- Upstream carriers are irrelevant to "is this a home line".