Internet network operator (ASN): what it is and how it is attacked
One organisation's own network on the internet, identified by a number so every other network knows whose it is.
Also known as
- ASN
- autonomous system
- AS number
- BGP network
- peering
Typing any of them into the editor finds this object.
Why it matters on a security diagram
It is how you tell whose infrastructure an address actually belongs to, which is the difference between a supplier's server and a hosting provider that rents to anyone.
How it gets attacked, and what reduces it
How it gets attacked
- Address ranges announced by a network with no right to them, pulling traffic somewhere it was never meant to go
- Operators with little oversight renting space for short-lived hostile infrastructure
What reduces it
- Publish which networks are allowed to announce your address ranges, and monitor for announcements that are not yours
- Check who operates an address block before treating traffic from it as ordinary
Where it sits
- Group
- Network · The paths traffic travels along.
- Whose side, by default
- Bystander · No relationship with us and no choice in the matter: an unwitting hosting provider, a stranger's compromised machine.
- Catalogue identifier
- asn
Reviewed . CC BY 4.0.
Others in network
- The internetWAN · public networkEverything outside your organisation's control.
- Routergateway · layer 3Sends information from one network to another, the way a junction sends cars down different roads.
- Switchlayer 2 · LAN switchConnects the devices inside one building or floor, passing each message only to the machine it is addressed to.
- Remote access gatewayVPN · VPN concentrator · remote accessThe door staff use to reach the internal network from outside.
- Address rangeCIDR · subnet · IP rangeA group of numbered addresses on a network, written as a single line such as 192.0.2.0/24 rather than listed one by one.
The network group lists all 6 of them side by side.
Internet network operator on your own diagram
Open the editor, press N, and type ASN. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.
Open the diagram maker