asn

asn [options] [target]
asn [-v] -l [server options]

asn is a comprehensive network reconnaissance and OSINT command-line tool written in Bash. It performs lookups on IP addresses, AS numbers, prefixes, hostnames, URLs, and organization names, combining data from numerous sources to produce detailed reports.
For AS numbers, the tool retrieves organization name, RIR allocation region, IXP presence, global AS ranking, BGP statistics, peering relationships, and BGP incident history including hijacks and route leaks over the past 12 months.
For IP addresses, it performs route lookups with ASN data, IP reputation scoring from multiple threat intelligence feeds, abuse contact information, and optional AS path tracing using mtr. The detailed trace mode adds RPKI route origin validation at each hop, detecting potential route leaks and BGP hijacks.
Additional modes support bulk IP geolocation from log files, country-level CIDR block enumeration, Shodan-based vulnerability scanning, transit provider identification through BGP update analysis, and organization-based network range discovery.
The tool can operate as a self-hosted web server, providing browser-based access and a JSON API for integration with other tools. Server mode supports access controls, custom bind addresses, and can be deployed as a systemd service.
Data sources include Team Cymru, PeeringDB, CAIDA ASRank, RIPEStat, ipinfo.io, ip-api, Shodan InternetDB, GreyNoise, IPQualityScore, Cloudflare Radar, ISC DSHIELD, NIST NVD, and the Prefix WhoIs project.

-t

Enable AS path trace to target (default behavior for IP targets).

Disable path tracing for IP targets. Disable additional INETNUM/origin lookups for AS targets.

Enable detailed trace mode with RPKI validation, route leak detection, and BGP hijack warnings.

ASN suggestion mode. Find all AS numbers and names matching the target string.

Transit/upstream lookup. Analyze BGP updates and AS paths to infer transit providers.

Country CIDR mode. Output all IPv4/IPv6 blocks allocated to the specified country.

Bulk geolocation mode. Extract and geolocate all IP addresses from input with occurrence statistics.

Shodan InternetDB scan. Query for CVEs, CPEs, tags, open ports, and hostnames. Supports multiple mixed targets and stdin.

Force interpretation of target as an organization name, bypassing automatic target type detection.

Compact JSON output for programmatic consumption.

Pretty-printed JSON output for readability.

Monochrome mode. Disable all colored output.

Force IPv4-only connectivity during traces and server mode.

Launch server mode. Starts a web interface for browser-based lookups and traceroutes. Default binding is 127.0.0.1:49200.

Verbose/debug mode. Display all queried URLs and log output to $HOME/asndebug.log.

Display usage information.

$HOME/.asnrc

Shell configuration file for overriding defaults. Supports settings such as MTRROUNDS, DETAILEDTRACE, FORCEIPV4, MAXCONCURRENTSHODANREQUESTS, MONOCHROME_MODE, and server bind address/port.

ipinfo.io API token for enhanced geolocation data.

IPQualityScore API token for advanced threat intelligence.

Cloudflare Radar API token for BGP incident data.

--allow host[,host,...]

Restrict connections to specified hosts.

Restrict connections using a host list file.

Block specified hosts from connecting.

Block hosts listed in a file.

Maximum simultaneous connections (default: 100).

Requires Bash v4.2 or later. Path tracing with mtr requires root privileges or CAPNETRAW capability. Several external dependencies must be installed: curl, whois, bind9-host (or equivalent), mtr, jq, ipcalc, grepcidr, nmap, ncat, and aha. Some features depend on optional API tokens for full functionality. The tool queries numerous external services, so an active internet connection is required.

asn was created by nitefood as a quick OSINT command-line utility for investigating network data during incident response. It was featured in the Security Trails blog as a notable ASN lookup technique. The project is open source, licensed under MIT, and actively maintained with contributions from the community. It has grown from a simple lookup script into a comprehensive network reconnaissance platform with server mode, JSON API, and integration with major threat intelligence feeds.

mtr(8), whois(1), nmap(1), dig(1), traceroute(1), jq(1), curl(1)