Skip to content
Published on March 8, 20267 min read

ASN and BGP Routing: How Internet Traffic Finds Its Path

What an autonomous system is, how BGP chooses a path between 88,000 of them, with real AS paths from RIPE's collectors and from our own traces.

asnbgproutinginternet-infrastructure

The internet is not one network but tens of thousands of them, which agree to carry each other's traffic. Each is an autonomous system (AS), identified by a number (ASN), and BGP (Border Gateway Protocol) is how they tell each other which addresses they can reach. This guide explains both with real data: AS paths recorded by RIPE's route collectors and traceroutes from our own servers, on 7 October 2026.

What an autonomous system is

An AS is a network, or a group of networks, run by one organisation with one routing policy: an internet provider, a cloud or hosting company, a university, a large enterprise. Its number is assigned by one of the five regional internet registries (AFRINIC, APNIC, ARIN, LACNIC, RIPE NCC). ASNs were 16-bit numbers (1 to 65,535) and are now 32-bit, up to 4,294,967,295. On 7 October 2026, RIPE's route collectors saw 88,105 distinct ASNs in the global routing table.

The networks that appear in the measurements below:

ASNOperatorRole in our examples
AS24940Hetzner OnlineHosts our server in Falkenstein, Germany
AS16276OVHcloudHosts our server in Gravelines, France
AS20473Vultr (The Constant Company)Hosts the test destination in New Jersey
AS201011Core-BackboneCarries Hetzner's traffic across the Atlantic
AS1299Arelion (formerly Telia Carrier)Transit provider, from Hamburg to Singapore
AS174CogentTransit provider
AS3257GTTTransit provider
AS13335CloudflareOperates 1.1.1.1

What BGP does

Each AS announces the blocks of addresses it owns, called prefixes, to the networks it connects to. Each of those passes the announcement on, adding its own ASN in front. The list of ASNs a route has crossed is its AS path. Vultr, for example, announces 108.61.128.0/19, the block that contains our New Jersey test host. Here is how some networks connected to RIPE's collector in London saw that prefix:

1828 20473
36924 1299 20473
15692 174 20473
286 3257 20473
917 60068 174 20473
5511 7922 7922 20473

Read each line from right to left. 20473 is Vultr, where the route starts. In the second line, Vultr's route reached Arelion (1299), which passed it to the network that shared it with the collector. 174 is Cogent and 3257 is GTT, two other transit providers. In the first line, 1828 (Unitas Global) is connected to Vultr directly. The last line shows prepending: Comcast (7922) repeats its own number to make the path look longer, a common way to make a route less attractive to others.

Across the 325 paths the collectors held for this prefix that day, one came straight from Vultr, 50 crossed 2 ASNs, 172 crossed 3, 90 crossed 4, 11 crossed 5, and one, prepending included, showed 7. Most of the internet is two or three networks away from most of the rest.

How BGP chooses between paths

A router usually learns several paths to the same prefix. It keeps one, by applying a fixed order of criteria (simplified):

  1. Local preference: a value the operator sets according to its own policy. It comes first, and it is mostly about money.
  2. Shortest AS path: fewer networks to cross.
  3. Origin type, then MED (a preference expressed by the neighbouring network).
  4. Routes learned from another network (eBGP) over routes learned internally (iBGP).
  5. Closest exit: the lowest internal cost to leave the network, also called hot-potato routing.
  6. Tie-breakers, such as the oldest route or the lowest router ID.

Nothing in that list measures latency, bandwidth or loss. The money part follows business relationships:

  • Transit: a network pays a provider to reach the whole internet. Arelion is one of Hetzner's transit providers: in our trace to Singapore, every hop from Hamburg to Singapore belongs to AS1299.
  • Peering: two networks exchange traffic between their own customers, usually without paying each other, either over a direct link or at an internet exchange point (IXP).
  • A network prefers routes from its customers (they pay), then from its peers (free), then from its providers (it pays). And it only passes routes learned from peers and providers on to its customers.

The result is the cheapest acceptable path for each network along the way, not the fastest one for you. Our trace from Germany to Sydney takes 341 ms when the distance alone would allow about 162 ms; in our study of cloud latency from 33 cities, Johannesburg reached São Paulo through Europe. Hot-potato routing also makes most paths asymmetric: each network hands the traffic off at its nearest exit, so the way back is often not the way there.

Seeing AS boundaries in a traceroute

With mtr -z, each hop shows the AS that announces its address. To the same New Jersey host, the same minute, from our two servers:

From Falkenstein (Hetzner)
  4. AS24940  juniper5.dc2.nbg1.hetzner.com         0.0%   100    3.0   5.2   2.8  65.6   9.2
  5. AS201011 ae12-499.nbg40.core-backbone.com      0.0%   100    3.2   3.0   2.7   3.3   0.1
  6. AS201011 ae7-2093.nyk10.core-backbone.com      0.0%   100   86.6  86.7  86.5  87.0   0.1
  7. AS???    ???                                  100.0   100    0.0   0.0   0.0   0.0   0.0
 10. AS20473  66.55.138.149.vultrusercontent.com    2.0%   100   85.7  85.9  85.6  87.3   0.2
 11. AS20473  108.61.149.182.vultrusercontent.com   0.0%   100   86.2  86.4  85.9 107.1   2.1

From Gravelines (OVHcloud)
 10. AS16276  be102.lon-drch-sbb1-nc5.uk.eu         1.0%   100    3.8   3.7   3.5   4.1   0.1
 11. AS16276  nyc-ny1-sbb2-8k.nj.us                 0.0%   100   73.0  73.4  71.6  76.0   0.8
 13. AS???    nyiix.gi3-6.cr1.nyc1.choopa.net       0.0%   100   72.7  72.5  72.3  73.0   0.1
 17. AS20473  108.61.149.182.vultrusercontent.com   0.0%   100   71.7  71.7  71.5  73.0   0.2
  • From Falkenstein, Hetzner hands the traffic to Core-Backbone in Nuremberg (hop 5), which crosses the Atlantic (hop 6, New York), then Vultr takes over (hop 10).
  • From Gravelines, OVHcloud carries the traffic on its own network through London to New York, then hands it to Vultr at NYIIX, a New York internet exchange (hop 13). The exchange's addresses are not announced in BGP, hence AS???.
  • Two routes, two AS paths, and a 15 ms difference to the same server.

Three caveats when reading AS numbers in a trace: at a handover, the link between two networks is often numbered from one of them, so the boundary can appear one hop early or late; private addresses (10.x, 172.16 to 31.x, 192.168.x) have no AS at all; and the trace only shows the way out.

How connected these networks are

RIPEstat counts the networks seen directly next to each AS in BGP paths. On 7 October 2026: Arelion (AS1299) 2,646, Vultr (AS20473) 1,728, OVHcloud (AS16276) 537, Hetzner (AS24940) 267. A large transit provider such as Arelion sits next to thousands of networks; Vultr, which peers widely, next to more than a thousand; Hetzner, next to a few hundred, among them several transit providers.

When BGP goes wrong

  • Hijacks: an AS announces a prefix it does not own. In February 2008, Pakistan Telecom announced part of YouTube's address space; the route spread worldwide and diverted YouTube's traffic for about two hours.
  • Leaks: a network passes routes on where it should not, for example from one provider to another, and traffic detours through it.
  • Withdrawals: on 4 October 2021, Facebook withdrew the routes to its own DNS servers during maintenance, and its services were unreachable for about six hours.

RPKI route origin validation, now applied by most large networks, rejects announcements whose origin AS does not match what the address holder has published. It stops the simplest hijacks, not leaks.

Look it up yourself