Why ASN Matters More Than Country

Geolocation gets most of the attention in traffic analysis, but the more informative field is usually the autonomous system number. It describes who operates the network rather than where a lookup thinks the user is standing.

An autonomous system is an operator, not a place

The internet is a collection of independently administered networks, each identified by a number and each announcing which address ranges it carries. That announcement is how traffic finds its way.

Looking up the system number for an address tells you which organisation is responsible for routing it: a broadband provider, a mobile carrier, a hosting company, a university, or a large enterprise.

This is a fact about infrastructure rather than an inference. It comes from routing data that has to be accurate for the network to function at all.

Country is inferred and often wrong

Address-to-country mapping is built from registry records, latency measurements and self-reported data from operators. None of these are authoritative about where a device physically is.

Large operators shuffle address ranges between regions, and traffic routed through a privacy service or corporate network emerges wherever that service has capacity. The lookup reports the exit point, faithfully and uselessly.

Accuracy also varies enormously by region. Dense broadband markets map well; mobile networks and satellite services map poorly, sometimes placing a user on the wrong continent.

Infrastructure type is the useful classification

For detection purposes, the question that matters is whether traffic plausibly originates from a person's device. Whether the announcing network sells broadband to households or servers to companies answers that far better than a country name.

Traffic from a consumer access network arriving at consumer-like rates is unremarkable. The same request pattern from a hosting network is worth examining, because nobody browses casually from a rented server.

This distinction survives changes that break geolocation. A hosting provider remains a hosting provider regardless of which region the capacity sits in.

Stability makes it a better key

System numbers change rarely, and when a range moves between operators the change is visible in routing data rather than silently wrong in a database.

That stability makes the system number a reasonable grouping key for rate limits and anomaly baselines. Behaviour that is normal for a mobile carrier is abnormal for a university network, and the grouping captures it.

Country-level grouping mixes all of these together, so a baseline built on it describes a blend of unrelated populations and detects very little.

Neither field identifies anyone

Both are properties of a network segment shared by very large numbers of people. Neither narrows traffic to a household, let alone a person.

Their value is contextual: they set expectations against which the rest of a session is read. Used as evidence of identity, they produce the same collateral damage as any other coarse grouping applied to individuals.