AS237

AS237 is the active operational autonomous system of Merit Network, Inc., the nonprofit research-and-education (R&E) network founded in 1966 and governed by Michigan's public universities — the same registrant behind the dormant legacy AS181. Where AS181 announces nothing, AS237 carries Merit's live traffic: roughly 300–500 Gbps (mostly inbound) over about 4,000 miles of owned fiber across Michigan, serving 170+ communities of education, government, healthcare, libraries, and nonprofits. It is registered under ARIN to Merit Network Inc. (handle AS237, registrant org MICH-Z, name MERIT-AS-14), with an ARIN autnum top-level registration event of 1988-09-12 and a last-changed of 2012-04-02 — making it one of the oldest active ASNs in ARIN's registry. Canonical routing data (RIPEstat announced_space, 2026-06-20) shows 83 originated IPv4 prefixes covering 2,221,568 IPv4 addresses, and 9 IPv6 prefixes in active use; the higher figures reported by bgp.he.net (245 IPv4 / 17 IPv6) reflect announced prefixes including propagated/aggregate routes, not the primary origination count. CAIDA AS Rank confirms the ASN is seen and active: rank 1190, with a customer cone of roughly 29 downstream ASNs and 278 prefixes (largely Michigan higher-education institutions such as msu.edu and wayne.edu). Upstreams confirmed across sources include Arelion (AS1299), Cogent (AS174), and AT&T (AS7018), with NTT America and Hurricane Electric also seen; it peers at Equinix Chicago, DET-iX Detroit, Grand Rapids Internet Exchange, and Any2 Chicago. RPKI posture is strong — the majority of originations are ROA-valid (about 53 IPv4 + 6 IPv6 valid) with a single legacy IPv4 invalid (35.39.23.0/24 — a ROA mismatch, not a security incident). Merit operated the NSFNET backbone (1987–1995, a ~$39 million NSF award with IBM and MCI), founded and administered NANOG (1994–~2011, transitioned to NewNOG in 2011), and operates RADb (one of the largest public Internet Routing Registries). The only notable historical routing event is the authorized November 2012 RIPE NCC IPv6 darknet research experiment (the 2a00::/12 announcement that triggered RPKI alert emails) — a disclosed research activity, not a hijack; no notable public abuse signal was found as of 2026-06-20 in Spamhaus ASN-DROP (verified absent), CleanTalk, NANOG archives, or threat feeds. Merit also operates the ORION network telescope and the National Distributed Network Telescope (NDNT) — defensive academic darknet-measurement infrastructure used for research such as Mirai botnet identification, not abuse origination from AS237.

Operator

Merit Network, Inc. (nonprofit R&E network; ARIN registrant org MICH-Z, handle AS237, Ann Arbor, MI) [Confirmed] — ARIN RDAP (rdap.arin.net/registry/autnum/237), merit.edu/about

Country / RIR

US, ARIN [Confirmed] — ARIN RDAP autnum

Allocated

1988-09-12 (ARIN autnum top-level registration event — a first-party RIR fact, NOT an IEEE date); last changed 2012-04-02 [Confirmed] — ARIN RDAP autnum top-level events

AS name

MERIT-AS-14 [Confirmed] — ARIN RDAP autnum (name)

Org status

active independent nonprofit corporation (Merit Network), governed by Michigan's public universities; founded 1966 as the Michigan Educational Research Information Triad by MSU, U-M, and Wayne State [Confirmed] — merit.edu/about/history, en.wikipedia.org/wiki/Merit_Network

Contacts

abuse@merit.edu (+1-734-527-5740); ipreg@merit.edu (admin); operations@merit.edu / noc@merit.edu (+1-734-763-3448); peering@merit.edu; HQ 880 Technology Drive, Suite B, Ann Arbor, MI 48108 [Confirmed] — ARIN RDAP autnum vcards, peeringdb.com/asn/237

Security/abuse context (NEUTRAL, DATED)

no notable public abuse signal as of 2026-06-20. AS237 is absent from Spamhaus ASN-DROP (verified 2026-06-20 against published spamhaus.org/drop/asndrop.json; 430 ASNs in list, AS237 not present). No Spamhaus SBL/DROP listing signals found via available public feeds. CleanTalk shows only background-noise spam activity for individual IPs within Merit's large address space (no ASN-level blacklisting). NANOG archive searches for AS237 return only administrative references (list hosting at merit.edu, IRR tutorials) — no abuse or routing-incident threads found. The one documented routing anomaly was the authorized Nov-2012 RIPE NCC IPv6 darknet experiment (2a00::/12), resolved with RIPE NCC coordination — research, not abuse. Merit operates the ORION network telescope (collecting unsolicited/darknet traffic since ~2005; arxiv preprint 2510.25050, Oct 2025) and the National Distributed Network Telescope (NDNT) — both defensive academic research infrastructure; Merit also used the telescope for Mirai botnet identification research. These are inbound measurement activities, not abuse origination from AS237. [Confirmed for ASN-DROP absence and 2012 event; Likely for full SBL/CleanTalk survey] — spamhaus.org/drop/asndrop.json (verified), ripe.net (routing-wg 2012-November, darknet experiment), cleantalk.org/blacklists/as237, merit.edu/research/projects/orion-network-telescope/, arxiv.org/abs/2510.25050

Network & routing

Network type

regional research and education (R&E / NREN) network; AS237 is Merit's ACTIVE operational network (contrast AS181, dormant) [Confirmed] — merit.edu/about, peeringdb.com/asn/237

Size / routing

83 IPv4 prefixes + 9 IPv6 originated (canonical RIPEstat announced_space, 2026-06-20); 2,221,568 IPv4 addresses (RIPEstat announced_space v4, 2026-06-20); customer cone ~29 downstream ASes / 278 prefixes (CAIDA rank 1190, seen:true) [Confirmed] — stat.ripe.net/data/routing-status/data.json?resource=AS237, asrank.caida.org/asns/237, bgp.tools/as/237 (note: bgp.he.net reports 245 IPv4 / 17 IPv6 announced, which includes propagated/aggregate routes not counted in origination — corroborating context only, not the primary count)

Peering/upstreams

upstreams include Arelion AS1299, Cogent AS174, AT&T AS7018 (both routing sources), plus NTT America and Hurricane Electric (bgp.he.net); ~49–51 peers; Merit runs a Selective peering policy (peering@merit.edu) [Likely for counts/upstreams; Confirmed for Selective policy] — bgp.he.net/AS237, bgp.tools/as/237, peeringdb.com/asn/237

RPKI

strong ROA adoption — ~59 valid originations (~53 IPv4 + 6 IPv6) and 1 legacy IPv4 invalid (35.39.23.0/24, a ROA mismatch — not a security incident); bogon flag noted (likely legacy address-management artifact, not malicious) [Likely] — bgp.he.net/AS237, bgp.tools/as/237

Notable usage

Merit operated the NSFNET backbone (1987–1995, ~$39M NSF award with IBM and MCI), founded and administered NANOG (1994–~2011, transitioned to NewNOG 2011), and operates RADb (IRR). AS237 hosts academic domains incl. msu.edu and wayne.edu; Internet2 member since the 1990s

[Confirmed] — merit.edu/about/history, merit.edu/research/.../nanog, merit.edu/solutions/networking-security/radb, bgp.he.net/AS237

Related ASNs

AS181 (Merit's dormant legacy ASN); Merit holds additional ASNs (e.g. AS182–185, AS229–230, AS232) [Confirmed for AS181 sibling registrant; Confirmed for AS229/230/232 per enrichment masters]

IXP presence

Equinix Chicago, DET-iX (Detroit Internet Exchange), Grand Rapids Internet Exchange, Any2 Chicago [Likely] — peeringdb.com/asn/237, bgp.he.net/AS237, bgp.tools/as/237

Traffic

~300–500 Gbps, mostly inbound; ~4,000 miles of owned fiber; serves 170+ communities [Confirmed for traffic/footprint via PeeringDB + Merit] — peeringdb.com/asn/237, merit.edu/solutions/networking-security/peering-caching

Analyst note

Encountered as Merit Network's ACTIVE operational ASN (the live counterpart to the dormant AS181). allocated_date 1988-09-12 is read from the autnum TOP-LEVEL events[] (registration), not the entity/org-level decoy dates (MICH-Z 2009-12-08, MERIT-ARIN 2007-02-21, IN-ORG-ARIN 1999-02-18, NETWO26-ARIN 2002-09-20). Re-research (cycle 3, 2026-06-20): ipv4_address_estimate corrected to 2221568 (RIPEstat announced_space v4, 2026-06-20; prior value 539136 was stale from before the prefix count was corrected to 83 in cycle 2); ipv4_prefix_count 83 and ipv6_prefix_count 9 remain correct from cycle 2. CAIDA confirms rank 1190 / cone 29 ASNs / 278 prefixes / seen:true. AS237 confirmed absent from Spamhaus ASN-DROP; no NANOG abuse incident threads found.