There is no internet. There are sixty thousand networks that agreed to talk
The single most useful thing to understand about the internet is that it has no centre, no backbone owner and no master routing table. It is a voluntary interconnection of tens of thousands of independently run networks, each of which decides for itself who it will exchange traffic with and on what terms.
Nobody operates the whole thing. What holds it together is that each network announces, to its neighbours, which addresses it can deliver traffic to — and each neighbour passes that claim along. Out of many such claims, every network builds its own private picture of how to reach every part of the internet. There is no shared copy of that picture anywhere.
This is why the internet has no off switch, why an outage in one country rarely affects another, and also why a single misconfigured announcement can silently pull somebody else's traffic across the planet.
The autonomous system: the unit the internet is built from
An autonomous system is one network under one routing policy: a provider, a hosting company, a bank, a university, a content delivery network, a government. "Autonomous" is the operative word — it decides its own routing, and no outside party can change it.
Each gets a number, an ASN. The numbers were originally 16-bit, which allowed 65,536 of them; that space ran out and 32-bit numbers were standardised in 2012, which is why you now routinely see values far above 65535. Well over 100,000 have been allocated, and something on the order of 75,000 are visible in the global routing table at any moment — the difference being organisations that hold a number but do not currently announce anything with it.
The ASN is the field worth trusting when you look up an address, and the reason is its source. A country in a geolocation database is a claim somebody entered. An AS is observable: the address sits inside a block that some specific network is announcing to its neighbours right now, and if it stopped, the address would become unreachable. There is nothing there to be out of date. You can see this for any address on our address lookup.
Some numbers are reserved rather than allocated: two blocks are set aside for private use inside an organisation, the way private IP ranges are, and they never appear in the public routing table. A handful more are reserved for documentation and examples.
How a packet actually finds its way
A router does not know a route to your computer. It knows a route to a block of
addresses — a prefix such as 203.0.113.0/24 — and it forwards anything in that block
towards the same neighbour.
When a packet arrives, the router looks up its destination and applies one rule:
longest prefix match. If it knows a route for 203.0.113.0/24 and
another for 203.0.0.0/16, the more specific one wins, because a more specific
announcement means someone closer to the destination is claiming it.
That single rule has two consequences that explain a great deal:
- Splitting a block makes it win. Announcing a smaller, more specific piece of your own space overrides the larger announcement. This is how traffic engineering is done — and, when done by someone else with your addresses, how a route hijack works.
- Most routers know almost nothing. Your home router has one route: "everything, send it upstream". A default route is what lets a device participate in the internet without knowing anything about it.
The routers that have no default route — that must know a path to every announced prefix on earth — form what is called the default-free zone. Their tables currently hold on the order of a million IPv4 prefixes and more than 200,000 IPv6 prefixes, and both numbers grow every year. That growth is not academic: it sets the memory requirement for the hardware, and it is why routers get retired for being unable to hold the table rather than for being too slow.
BGP: the protocol that carries the claims
All of this runs on one protocol between networks: BGP. It is not clever. A network tells its neighbour "I can reach this prefix, and the path goes through these autonomous systems"; the neighbour adds itself to the path and may pass it on. Routes are chosen by policy first and path length second, which is important — BGP does not find the fastest route, it finds the one that policy permits.
The path list also serves as loop prevention: a network that sees its own number already in a path discards the announcement, because accepting it would create a circle.
What BGP has never had is proof. For most of its life, an announcement was believed because it arrived. If a network announced a prefix belonging to someone else — by mistake or otherwise — its neighbours had no way to tell, and traffic for those addresses started arriving in the wrong place. Several well-documented incidents have taken large services offline this way, some of them for hours, and at least one redirected a country's traffic through another continent.
The repair is RPKI: address holders publish a signed statement saying which AS is authorised to announce their prefixes, and networks reject announcements that contradict it. It is not universal, but a large share of the routing table is now covered and most major networks enforce it. There is also a broader set of agreed practices — filtering what you accept, filtering what you announce, keeping contact details accurate — that networks sign up to publicly.
Where addresses come from, and who pays for them
Addresses are not bought from "the internet". They come down a chain:
- IANA
- Holds the top-level pools and hands large blocks to the regional registries. Its IPv4 pool ran out in February 2011 and there is nothing left to hand out.
- Five regional registries
- ARIN for North America, RIPE NCC for Europe, the Middle East and Central Asia, APNIC for Asia-Pacific, LACNIC for Latin America, AFRINIC for Africa. They allocate to their members and maintain the public record of who holds what — the record you read in a registry lookup.
- Local registries (LIRs)
- Member organisations — providers, hosting companies, large enterprises — that receive blocks and assign parts of them to customers.
Membership is where the recurring cost sits. A registry is a membership organisation funded by its members, and the annual fee is on the order of a couple of thousand euros or dollars a year, varying by registry and by how much address space you hold. The exact figures are set by the members themselves and change from year to year, so the registry's own fee schedule is the only reliable source.
Then there is the IPv4 problem. The regional pools are exhausted — the European registry issued its last freely available block in November 2019 — so new IPv4 space is obtained on a transfer market, where an existing holder sells a block and the registry records the change. Prices are set by supply and demand and have been in the tens of dollars per address for several years, which makes a /24 — 256 addresses — a five-figure purchase. This is a real line item in a provider's budget and the main financial reason IPv6 keeps advancing.
IPv6 costs almost nothing by comparison: a new member typically receives a /32 as part of membership, which is 65,536 subnets of the standard /64 size, enough that the design question becomes how to number it readably rather than how to fit.
One distinction matters if you ever plan to change providers. Address space assigned to you by a provider is part of their block, and you give it back when you leave — renumbering everything. Space you hold directly from a registry is yours and moves with you. That difference is one of the main reasons an organisation becomes a registry member rather than staying a customer.
Transit, peering, and why some traffic is free
Networks exchange traffic in two ways, and the difference is commercial rather than technical.
- Transit — you pay
- A larger network agrees to carry your traffic to everywhere, and announces your prefixes to the rest of the internet on your behalf. Billing is normally by bandwidth, measured so that brief spikes do not dominate the bill.
- Peering — usually nobody pays
- Two networks connect directly and exchange only traffic destined for each other and their own customers. Not transit: your peer will not carry your traffic onward to third parties. Both sides save money, so it is common where volumes are roughly balanced.
Most peering happens at an internet exchange — a shared switching fabric in a data centre where hundreds of networks connect once and then peer with many others over that single port. The large European exchanges carry many terabits per second at peak. For a new network, a port at a nearby exchange is usually the cheapest way to reach a lot of destinations directly.
The informal tiering follows from this. A network that reaches the entire internet purely through peering, buying transit from nobody, is called tier 1; there are only a handful. Everyone else buys some transit, peers where it makes sense, and sits somewhere in between.
How to become your own branch of the internet
Becoming an independently routed network is a well-worn procedure. It is not cheap, but there is no gatekeeper deciding whether you are allowed.
- Join a regional registry as a member. This is the paperwork step: a legal entity, a contract, an annual fee. Everything below follows from membership.
- Get an AS number. Registries issue one on the basis that you will have a routing policy of your own — normally meaning more than one connection to the outside world.
- Get address space. An IPv6 block comes with membership. IPv4 means the waiting list, if the registry still has one, or the transfer market.
- Arrange at least two upstreams. One transit provider is a single point of failure and, strictly, does not require your own AS at all. Two — or one transit plus an exchange — is the point at which having your own number starts to pay for itself.
- Get hardware that can hold the table. A router in the default-free zone needs memory for a million-plus IPv4 routes and rising, per session. This is where the equipment budget concentrates, and where cheap hardware fails a year later rather than on day one.
- Publish your intentions. RPKI statements saying which AS may announce your prefixes, and routing-registry objects describing your policy. Networks increasingly refuse to accept announcements without them, so this is no longer optional in practice.
- Take delegation of reverse DNS. The registry delegates the reverse zone for your block to your nameservers. Skipping it is a common oversight with a specific consequence: mail from your addresses gets refused or penalised by a large share of receiving systems.
- Check what your country requires. This part is not technical and varies enormously — some jurisdictions require registration or a licence to sell connectivity to the public, others require nothing at all.
The realistic cost is dominated by three things: transit, which is ongoing and scales with your traffic; IPv4 space, which is a large one-off purchase at current market prices; and hardware. The registry fee, which people ask about first, is usually the smallest of them.
What this means when you look at an address
Once the structure is clear, an address lookup reads differently. The country is a database claim and it is right most of the time at the level of a country and much less often below that. The autonomous system is an observation, and it tells you what kind of network you are dealing with — which is nearly always the question you actually had. The registry record tells you who is accountable for the block and where to send a complaint, and that contact is monitored more often than people assume.
And latency, which people reach for first, is bounded by physics rather than by equipment. Light in fibre covers roughly 100 km per millisecond in one direction, so a transatlantic round trip cannot be much under 60 ms no matter what anybody sells. If you want to see that bound in practice, measure a few destinations at different distances with real ICMP packets and compare the minimum times against the map — the numbers line up with the cable routes, not with the straight lines.