An autonomous system number answers a question an IP address cannot: which network carries the traffic. Addresses change. When a log line says 185.220.101.4 and you need to know who is behind it, the country field is the least useful column on the screen: hosting providers move addresses between countries, mobile carriers route subscribers through a handful of gateways, and a single anycast prefix can answer from three continents.
The autonomous system number is the part that stays put. It names the operator, and the operator is what you can act on.
What the autonomous system number means
An autonomous system is a set of IP prefixes under one routing policy. Every network that peers on the public internet has a number, from a small regional provider to a cloud with thousands of prefixes. The number is a fact about routing, not about geography, which is why it survives the cases where a country lookup fails.
Two addresses in the same block can map to different countries and still route through one network. When the complaint says the visitor is in Germany and the log says the Netherlands, the autonomous system number tells you whether you are looking at one operator announcing the prefix in two places.
Look up the number from the shell
curl -s "https://api.globus.studio/v2/asn?ip=77.88.8.8&format=json"{
"asn": "AS13238",
"asnum": 13238,
"asname": "Yandex LLC",
"as_domain": "yandex.net",
"ip": "77.88.8.8"
}asnum is the integer, ready for a database column. asname is the display name and as_domain is the domain the network publishes, when it publishes one. The reverse direction works with ?asn=13238 for a name without an address.
Three places the autonomous system number earns its keep
Filtering abuse by address fails because hosting addresses rotate. The numbers do not. A blocklist built on autonomous system numbers stays useful after the provider reassigns a range, and it produces far fewer rules.
Sorting signups before a manual review is another use. A signup from a hosting network and a signup from a residential connection are different risks, and the network name answers the question in one field.
Reading routing problems is the third. When a report says "the site is slow for some users", the autonomous system number in the sample log lines tells you whether the complaints come from one operator or from everywhere. One operator points at peering; everywhere points at your origin.
What the answer cannot tell you
The number does not say whether a visitor is honest, and it does not predict location. Privacy proxies and VPNs sit inside ordinary hosting networks, so a hosting network is a hint about infrastructure and nothing more.
The number also does not describe ownership. Companies rent address space, and the registered network may belong to an upstream provider that the customer never names. Read asname as the operator of the routing, which is what it is.
IPv6 works the same way
curl -s "https://api.globus.studio/v2/asn?ip=2001:4860:4860::8888&format=json"Most modern IPv6 addresses resolve to the same networks as their IPv4 siblings, so a firewall rule written once works for both. One autonomous system number covers both families, and the API refuses malformed input instead of guessing.
Speed and shape
The lookup is local and answers in tens of milliseconds over the network. The response is a small object, so it fits in a cache key without a schema change. Requests are rate limited together with the other address endpoints, and format=jsonp covers the browser case.
Where to take it next
Combine three fields and most address questions answer themselves: country from the geolocation endpoint, the autonomous system number from the ASN endpoint, and robot status from the bot detector. Country says where the request came from, the network says who carried it, and the bot check says whether a program sent it.
For a reference on how autonomous systems are numbered and why the range matters, see RFC 1930. The ASN lookup API page has the parameter table and the error list.