I want to extract upstream and downstream ASN for any given ASN, for example: https://www.cidr-report.org/cgi-bin/as-report?as=AS4826&view=2.0

My goal at the end is to generate ASN route graphic similar to this one: enter image description here

But in order to do so, I need a way to extract this kind of data from the BGP table. I have a hard time figuring out which ASN from the AS path can be considered upstream and downstream. Lets take this entry from the BGP table

    [TIME] => 05/02/20 00:00:00
    [PREFIX] =>
    [SEQUENCE] => 3
    [FROM] => AS55720
    [ORIGINATED] => 04/30/20 06:15:43
    [ORIGIN] => IGP
    [ASPATH] => 55720 24218 4826 38803 56203
    [NEXT_HOP] =>
    [UNKNOWN_ATTR(192, 16, 8)] => 02 02 00 02 01 95 00 c9
    [COMMUNITY] => 4826:1000 4826:5307 4826:7000 4826:53073 19996:19996
    [AGGREGATOR] => AS13335
    [LARGE_COMMUNITY] => 34872:10:104 34872:11:0 34872:100:49 34872:122:1
    [MULTI_EXIT_DISC] => 150

This ASN 4826 has 38803 on the right and 24218 on the left, here https://www.cidr-report.org/cgi-bin/as-report?as=AS4826&view=2.0 and other sites that show ASN up/down streams 38803 is marked as downstream, but why 24218 isn’t marked as upstreams when it’s right before 4826? And how exactly upstream and downstream is calculated?


  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 17, 2020 at 17:11

1 Answer 1


You need to remember that an AS path is relative to the network you're sourcing from. In your above example, just because AS24218 is to the left of Vocus (AS4826), doesn't necessarily mean they're an upstream. So, why? A lot of this comes down to how providers will select best paths for prefixes. Usually, there is a hierarchical order purely based on cost that is followed. E.g, similar to the below:

  • Customer Prefixes > PNI/Bilateral Peering > Multilateral Peering > Transit.

In your example, AS56203 is a customer of AS38803 who then is a customer of Vocus. Vocus will always send this traffic to their downstream customer as they may be able to bill for this traffic. Now we see AS24218, this AS may be a customer, or even a peer of Vocus (In reality, looks like they may peer on MyIX), since the originating prefix is a customer of Vocus, they will advertise this out Peering to AS24218.

However, the real point of interest with this AS Path is actually between AS55720 & AS24218. In this instance again, AS24218 may be a customer, peer or even a transit provider of AS55720.

It becomes really hard to tell in areas you're not familiar with providers. Unfortunately, to my knowledge Hurricane Electric do not publicly disclose how they create their graphs. I'm going to guess that HE build their graphs with the thought in mind that at some point a prefix will include a Tier 1 providers ASN in the AS Path and from there they can workout who the immediate transit ASes are.

(Please note, that both Hurricane Electric and CIDR Report can be wrong, their information is not always 100% accurate as majority of their information is a calculated guess in some way, shape or form)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.