AS349

AS349 is a legacy autonomous system number registered under ARIN to the United States Department of Defense (DoD), administered operationally by the Defense Information Systems Agency (DISA) out of its Columbus, Ohio facility. It is one of a contiguous run of ASNs (AS306 through AS371) that ARIN serves as a single block record, DNIC-ASBLK-00306-00371, rather than as individual per-AS objects — a standard ARIN convention for the old DoD Defense Data Network (DDN) / NIC allocations. Unlike many low-numbered DoD ASNs that sit dormant, AS349 is actively routed: it originates the legacy Class A-derived block 55.23.0.0/16 as a /16 aggregate plus a spread of more-specific /24s, together with the IPv6 block 2608:18b:2800::/40. RIPEstat shows it visible to 324 of 326 IPv4 RIS peers and 324 of 324 IPv6 peers — effectively global visibility — first seen routed in July 2011 and last seen in late June 2026. It behaves as a single-homed government stub: no transit role, a single observed neighbour (its DoD sibling AS306), and no public PeeringDB profile or open peering policy. Its prefixes are sub-used by the National Guard Bureau and U.S. Army units. No public abuse signal was found as of June 2026 (absent from Spamhaus ASN-DROP and community bad-ASN blocklists), consistent with a restrictive DoD network whose hosts do not respond to internet-wide ICMP probes.

Operator

United States Department of Defense (DoD), administered by DISA-Columbus; ARIN holder DNIC-ASBLK-00306-00371 [Confirmed] — RIPEstat as-overview holder string, ipinfo.io/AS349, ip2location.com/as349

Country / RIR

US, ARIN [Confirmed] — RIPEstat abuse-contact-finder (authoritative_rir: arin)

Allocated

1989-06-30 (ARIN registry date for the DoD block DNIC-ASBLK-00306-00371; this is the autnum top-level registration event, a first-party RIR fact — NOT an IEEE date); last changed 2025-09-12 [Confirmed] — ARIN RDAP autnum top-level events (corroborated by ipinfo.io)

Org status

active U.S. federal government agency (DoD); administered by DISA, 300 North James Road, Whitehall, OH 43213; NOC/abuse disa.columbus.ns.mbx.hostmaster-dod-nic@mail.mil [Confirmed] — RIPEstat abuse-contact-finder, RDAP mirrors via ipinfo.io

Security/abuse context (NEUTRAL, DATED)

no notable public abuse signal found as of 2026-06-28 — absent from Spamhaus ASN-DROP, absent from community bad-ASN blocklists (brianhama, bountyyfi, C0nw0nk), no NANOG incident threads, stable BGP with no anomalies; hosts do not respond to internet-wide ICMP, consistent with restrictive DoD policy

Network & routing

Network type

government stub AS — single-homed, no transit provided, no public peering; internal DoD / NIPRNet routing [Confirmed] — ipinfo.io/AS349, bgp.he.net/AS349

Size

16 IPv4 prefixes (~65,536 addresses, primarily 55.23.0.0/16) and 1 IPv6 prefix (2608:18b:2800::/40) [Confirmed] — RIPEstat announced-prefixes, bgp.he.net/AS349

Routing/peering

globally visible — 324/326 IPv4 RIS peers, 324/324 IPv6 RIS peers; 1 observed neighbour (AS306, DoD sibling) which is the sole observed upstream/peer; no IXP presence; no open peering policy (external internet routing handled via DISA-approved NIPRNet gateways) [Confirmed for visibility/neighbour; Likely for peering-policy framing] — RIPEstat routing-status, bgp.he.net/AS349, bgp.tools/as/349

RPKI

no RPKI coverage detected — 0 valid / 0 invalid ROAs observed; RIPEstat rpki-validation was skipped (no prefix supplied to the runner), so this rests on bgp.he.net [Likely] — bgp.he.net/AS349

Notable usage

55.23.0.0/16 derives from the legacy 55.0.0.0/8 Class A block historically assigned to DoD; prefixes are sub-allocated to the National Guard Bureau and U.S. Army Intelligence and Security Command (USAISC) [Likely] — bgp.he.net/AS349, ipinfo.io/AS349

Related ASNs

AS306 (DoD sibling, sole observed neighbour); the whole DNIC-ASBLK-00306-00371 block (AS306–AS371) is registered to DoD under the same record [Confirmed] — bgp.he.net/AS349, RIPEstat as-overview block string

Routing history

first seen 2011-07-22 (55.23.0.0/16), last seen 2026-06-26 (55.23.22.0/24); a 2026-06-28 as-overview "announced: false" is a point-in-time snapshot, not a withdrawal of the longer-running routing record [Confirmed] — RIPEstat routing-status

Analyst note

ARIN RDAP serves the block record (AS306, startAutnum 306, endAutnum 371) for any query in range; the 1989-06-30 top-level event is the block's registration date and the authoritative allocated_date for AS349. RDAP entity-level POC events (1993-05-26, 2009-06-24) are contact-record dates, not the allocation date. CAIDA AS Rank returned HTTP 502, so as_rank / customer_cone are Unknown.