In network reconnaissance, infrastructure mapping, and cloud perimeter auditing, identifying an organization’s complete IP footprint requires finding its registered Autonomous System Numbers (ASNs) and associated IP prefix announcements. Autonomous Systems (AS) represent large networks or collections of networks with a unified routing policy under BGP (Border Gateway Protocol). While web-based BGP lookup portals (like Hurricane Electric or BGPView) allow manual searching, querying dozens of corporate entities and extracting CIDR blocks into command-line automation pipelines manually is slow. ASNmap, developed by ProjectDiscovery, is an ultra-fast reconnaissance tool built specifically to automate ASN and CIDR discovery.
Written in Go, asnmap queries comprehensive global routing registries to resolve company names, domains, and individual IPs into clean, structured ASN metadata and CIDR prefixes directly in the Linux terminal.
Why ASN Discovery Matters in Reconnaissance
Mapping ASNs provides the broad foundation for comprehensive infrastructure audits:
- Uncover Hidden Subnets: Discover IP ranges owned by an organization that do not share common domain names or DNS records.
- Avoid Third-Party Cloud Confusion: Distinguish between IP blocks owned and routed directly by an enterprise versus transient IP addresses hosted on AWS, Azure, or Cloudflare.
- Direct Pipeline Integration: Discovered CIDRs can be piped directly into
mapcidrfor subnet expansion and intonaabuorhttpxfor active port probing.
Installing ASNmap on Linux
You can install ASNmap via pre-compiled GitHub binaries or build directly using the Go compiler:
# Method 1: Download Official Pre-compiled Binary (Recommended)
curl -s https://api.github.com/repos/projectdiscovery/asnmap/releases/latest | grep "browser_download_url.*linux_amd64.tar.gz" | cut -d : -f 2,3 | tr -d \" | wget -qi -
tar -xvf asnmap_*_linux_amd64.tar.gz
sudo mv asnmap /usr/local/bin/
asnmap -version
# Method 2: Via Go (Requires Go 1.21+)
go install -v github.com/projectdiscovery/asnmap/cmd/asnmap@latestCommand Flags and Query Options
The table below summarizes common command-line flags in ASNmap:
| Flag | Functionality | Usage Example |
|---|---|---|
-a, -asn <asn> |
Query specific ASN (e.g., AS15169) | asnmap -a AS15169 |
-i, -ip <ip> |
Lookup ASN associated with IP address | asnmap -i 8.8.8.8 |
-d, -domain <domain> |
Lookup ASN and CIDRs for a domain | asnmap -d google.com |
-o, -org <name> |
Query company or organization name | asnmap -org "GitHub, Inc." |
-silent |
Outputs clean CIDRs only (suppresses banner) | asnmap -d example.com -silent |
-json |
Outputs structured JSON metadata | asnmap -a AS13335 -json -o cloudflare.json |
-c, -csv |
Outputs tabular CSV format | asnmap -org "Uber" -csv -o uber_asns.csv |
Practical Workflow Examples
1. Resolving an Organization to its Announced CIDR Blocks
To identify all announced IP prefixes belonging to an organization:
asnmap -org "DigitalOcean" -silentOutput format:
104.131.0.0/16
104.248.0.0/16
138.68.0.0/16
...2. Reverse ASN Lookup from an IP Address
Determine which autonomous system owns and routes a suspicious IP address:
asnmap -i 1.1.1.1 -jsonReturns structured JSON detailing the ASN (AS13335), Organization name (CLOUDFLARENET), country code, and parent CIDR block.
3. High-Speed Pipeline: ASNmap to Naabu Port Scanning
Discover an organization’s network perimeter and immediately scan for open web services in one automated command chain:
asnmap -d example.com -silent | naabu -top-ports 100 -silent -o open_ports.txtFrequently Asked Questions
Does ASNmap require third-party API keys?
No. ASNmap queries ProjectDiscovery’s public routing dataset and global BGP WHOIS aggregators directly with zero authentication or API tokens required.
Does ASNmap output IPv6 prefix announcements?
Yes. By default, ASNmap returns both IPv4 and IPv6 CIDR prefix ranges announced by the target Autonomous System.