AS397

AS397 is a U.S. Department of Defense autonomous system number registered under ARIN to Air Force Systems Networking (ARIN org handle 7ESG, address Maxwell AFB, Alabama). The important structural fact for triage is that AS397 is not an individually delegated autnum: ARIN's RDAP returns it as one member of a single block-level record spanning AS379 through AS508, named AFCONC-BLOCK1-AS, so its registry dates and holder are the block's and apply uniformly across that range. Administrative, technical, and abuse handling is performed by DISA Columbus (300 North James Road, Whitehall, OH; disa.columbus.ns.mbx.arin-registrations@mail.mil), a typical arrangement for military ARIN objects. Operationally the ASN is dormant in the global routing table: RIPEstat reports announced:false with an empty announced-prefixes list, zero IPv4 and zero IPv6 prefixes, zero observed neighbours, and zero of 323 (v4) / 321 (v6) RIS peers seeing it. That inactivity is corroborated independently by Hurricane Electric (bgp.he.net, 0 prefixes / 0 peers) and by ipinfo.io, which labels the ASN "Inactive." No PeeringDB record, operator-run peering policy, or dedicated public website was located for this ASN or its block. No notable public abuse signal was found across AbuseIPDB, Spamhaus, Talos, VirusTotal, or NANOG archives as of 2026-07-02 — a sourced null, consistent with a reserved/unused slot in a large DoD ASN block rather than an actively routed network.

Operator

Air Force Systems Networking (U.S. Air Force / DoD; ARIN org handle 7ESG, Maxwell AFB, AL) [Confirmed] — ARIN RDAP autnum registrant entity (rdap.arin.net/registry/autnum/397)

Country / RIR

US, ARIN [Confirmed] — ARIN RDAP; RIPEstat abuse-contact-finder (authoritative_rir: arin)

Allocated

1989-08-04 (ARIN registry date from autnum top-level events[]; a first-party RIR fact, NOT an IEEE date); last changed 2008-06-06 [Confirmed] — ARIN RDAP autnum top-level events

Org status

active in the ARIN registry (status: active), but operationally inactive in global BGP routing [Confirmed] — ARIN RDAP

Contacts

DISA Columbus, disa.columbus.ns.mbx.arin-registrations@mail.mil, tel +1-844-347-2457 ext2 (abuse/admin/tech, REGIS10-ARIN, Whitehall, OH); registrant address Maxwell AFB, AL 36114 [Confirmed] — ARIN RDAP entities

Security/abuse context (NEUTRAL, DATED)

no notable public abuse signal found as of 2026-07-02 — not in AbuseIPDB, Spamhaus, Talos, VirusTotal, or NANOG archives. CleanTalk's "AS397391" hit is a different ASN and is excluded; general USAF security incidents were reviewed but do not tie to AS397's address space

Network & routing

Network type

U.S. federal government / military network (Department of the Air Force under the DoD Information Network, administered via DISA); not a commercial ISP, transit, or content network [Confirmed] — ARIN RDAP, ipinfo.io/AS397

Size

dormant — 0 IPv4 prefixes / 0 IPv4 addresses and 0 IPv6 prefixes announced (RIPEstat announced_space v4/v6 both 0) [Confirmed] — RIPEstat as-overview / announced-prefixes / routing-status (2026-07-02)

Routing/peering

NOT announced — announced:false; 0 RIS peers seeing it (0/323 v4, 0/321 v6); 0 observed neighbours; no visible upstreams or peers [Confirmed] — RIPEstat routing-status / announced-prefixes

Peering policy

Unknown / not publicly published — no PeeringDB record for AS397; no AS397-specific Air Force or DISA peering-policy page located [Unknown] — peeringdb.com (no AS397 record)

RPKI

not assessable — AS397 announces no prefixes, so there are no ROAs to validate; RIPEstat rpki-validation skipped (no prefix) [Unknown] — RIPEstat rpki-validation (skipped)

AS rank / customer cone

Unknown — CAIDA ASRank/customer-cone source timed out and was not independently corroborated [Unknown] — CAIDA (timeout in canonical fetch)

Notable usage

no active BGP announcements, originated prefixes, or observed peers; consistent with a reserved/held slot in the DoD AS379–AS508 block; ipinfo.io lists status "Inactive" [Confirmed] — bgp.he.net/AS397, ipinfo.io/AS397

Registry block

AS397 is registered as part of ARIN block AS379–AS508 (handle AS379, name AFCONC-BLOCK1-AS), not an individually delegated record; block dates apply to every ASN in the range [Confirmed] — ARIN RDAP (startAutnum 379, endAutnum 508)

Analyst note

Encountered as a dormant, block-registered DoD ASN. WHOIS/RDAP resolves via a single AS379–AS508 block record (AFCONC-BLOCK1-AS) rather than a per-ASN delegation; no live routing, no public peering surface. Clean, inactive ASN.