Netflix IP Ranges
Netflix runs two networks rather than one. AS2906, registered with ARIN to Netflix Streaming Services Inc., peers at Netflix's own points of presence; AS40027 is what the Open Connect appliances embedded inside ISP networks use. A rule written against one of them says nothing about the other.
- Provider
- Netflix
- Primary ASN
- AS2906
- Category
- Tech
- Headquarters
- Los Gatos, CA, USA
- Announced IPv4 prefixes
- 245
- Registry
- ARIN
Known IP ranges
These prefixes are currently announced to the global routing table by AS2906 (AS-SSI - Netflix Streaming Services Inc.). Prefix sets change over time - use WHOIS Lookup for the authoritative record on any specific address.
45.57.0.0/17
66.197.128.0/17
64.120.128.0/17
23.246.0.0/18
192.173.64.0/18
66.197.192.0/18
198.38.96.0/19
69.53.224.0/19
108.175.32.0/20
64.120.240.0/20
2a00:86c0::/32
2607:fb10::/32
2a03:5640:8000::/33 (IPv6)
What does a Netflix IP mean in a privacy test?
A Netflix address is almost never a visitor. AS2906 space delivers video to Netflix clients; it hosts nothing for anyone else, and Netflix runs no crawler that fetches pages from other people's servers, so there is no Netflix bot to allow through a firewall. Seeing a Netflix address as your own visible IP would be odd for the same reason - that network carries streaming traffic outward and is not space anyone is offered an exit on.
Netflix publishes no address list - what stands in for one
There is no Netflix equivalent of api.github.com/meta. The Open Connect site documents how an ISP hosts an appliance - hardware requirements, BGP configuration, peering - and stops short of publishing which addresses to allow; the partner help centre behind it is deployment guidance rather than a feed. So the routing table is the record, and it carries two entries under the same ARIN registrant.
AS2906 announced 245 IPv4 prefixes and 284 IPv6 prefixes when this page was built, among them 45.57.0.0/17, 66.197.128.0/17 and 64.120.128.0/17. AS40027, the appliance ASN, announced 37 - a much smaller set including 45.57.40.0/23 and 207.45.72.0/23. That first one is worth a second look: 45.57.40.0/23 is a more specific carved out of the /17 that AS2906 announces. Same Netflix address space, advertised from inside an ISP rather than from a Netflix point of presence.
Netflix's own edge, and an appliance sitting inside your ISP
Netflix describes its delivery as a combination of intelligent clients, a central control system and a network of Open Connect appliances, with the audio and video components of a title served to the client over HTTP straight from an appliance. Those appliances sit in two kinds of place: at internet exchanges, and embedded inside larger ISP partner networks.
An embedded appliance is physically in the provider's facility and speaks BGP with the provider over AS40027. It is a directed cache - it serves only the customer prefixes the ISP announces to it, which is why the same model of box reaches a different set of subscribers in a different network. For a subscriber this shows up as a Netflix-registered address whose path never leaves their own provider, which looks wrong in a traceroute and is not.
What neither ASN can tell you is anything about a person. Nothing on either network is rented to a customer, so there is no third-party machine to mistake for Netflix and no user traffic originating from it either. This is content moving in one direction.
Related tools
Frequently asked questions
What IP ranges does Netflix use?
Netflix announces 245 IPv4 prefixes and 284 IPv6 prefixes under AS2906, registered with ARIN to Netflix Streaming Services Inc.; 45.57.0.0/17, 66.197.128.0/17 and 64.120.128.0/17 are among the largest. A second ASN, AS40027, carries 37 further prefixes and is the one embedded Open Connect appliances use.
Why does a Netflix IP appear in my privacy test?
A Netflix address is almost never a visitor. AS2906 space delivers video to Netflix clients; it hosts nothing for anyone else, and Netflix runs no crawler that fetches pages from other people's servers, so there is no Netflix bot to allow through a firewall. Seeing a Netflix address as your own visible IP would be odd for the same reason - that network carries streaming traffic outward and is not space anyone is offered an exit on.
Does Netflix publish an IP allowlist?
No. The Open Connect documentation covers how an ISP deploys and peers with an appliance, not which addresses to permit, and there is no machine-readable feed to poll. The routing registry is the only authoritative record, and it holds two Netflix ASNs rather than one.
What is AS40027, and how is it different from AS2906?
AS40027 is the AS number embedded Open Connect appliances use to peer with the ISP hosting them; AS2906 is what Netflix peers with at its own points of presence. AS40027 announced 37 prefixes against AS2906's 245, and both are registered with ARIN to Netflix Streaming Services Inc.
Why does a Netflix address trace only as far as my own ISP?
Because the appliance serving it sits inside that ISP. An embedded Open Connect appliance announces Netflix prefixes to its host over BGP using AS40027, so the address belongs to Netflix while the path to it never leaves your provider's network. 45.57.40.0/23 on AS40027 is a more specific of the 45.57.0.0/17 that AS2906 announces.