Hurricane Electric network profile

Hurricane Electric: the IPv6-forward independent Tier 1

Hurricane Electric LLC is a Fremont, California based internet-backbone, colocation, and dedicated server operator, founded by Mike Leber and Mark Tinka in 1994 and still privately held. The company occupies an unusual position among Tier 1 backbones: it is one of the smaller operators by corporate revenue but one of the largest by measurable network-structure metrics such as IPv4 prefix count and global IPv6 reach. Unlike the large publicly-listed or telecom-conglomerate Tier 1s, Hurricane Electric remains a focused independent operator with a recognizable corporate personality shaped substantially by its founder.

The business mix is unusually broad for a Tier 1 backbone. Alongside IP transit and dark-fiber wholesale, Hurricane operates dedicated-server hosting, colocation in its Fremont 2 and Fremont FMT2 data centers, and a long list of free public services (IPv6 certification, tunnel brokering, BGP looking glass) that have given the company a community-engagement profile significantly larger than its revenue scale alone would suggest. The combination has made Hurricane Electric one of the most-recognized individual ASNs in the global IPv6 community.

AS6939 and the IPv4 prefix leadership

Hurricane Electric's primary autonomous system is AS6939. The ASN is widely cited as having one of the largest IPv4 customer cones and one of the largest IPv4 prefix counts among all global backbones, often ranking in the top positions of the CAIDA AS-rank measure. The prefix-count leadership reflects an unusually open peering and customer policy: Hurricane has historically been willing to provide transit or peering to operators that would not meet the stricter requirements of larger backbones, which produces a very large customer cone for a network of Hurricane's overall corporate scale.

The size-versus-business asymmetry is one of the distinctive features of AS6939. By customer-cone and routing-table metrics Hurricane sits alongside Cogent, Lumen, NTT, and Arelion at the top of the global ranking, but its absolute revenue and employee count are far smaller. The implication is that AS6939 attribution can surface in traceroutes and BGP analysis far more often than the company's public profile would suggest, and treating it as a niche operator misreads the structural position significantly.

The IPv6 push and tunnelbroker.net

Hurricane Electric is one of the longest-running and most consistent advocates for IPv6 deployment in the internet operator community. The company was an early native IPv6 backbone and has consistently published IPv6 reachability statistics, IPv6 BGP table coverage statistics, and operator-education materials promoting IPv6 adoption. The advocacy is more than marketing: Hurricane has invested heavily in IPv6 infrastructure to support the position, with global IPv6 routing-table coverage that consistently ranks among the most complete of any Tier 1 operator.

The tunnelbroker.net service is probably the single best-known Hurricane Electric product among the operator and enthusiast communities. It is a free IPv6-in-IPv4 tunnel- brokering service that has allowed individual users and small networks worldwide to obtain native-IPv6 connectivity over their existing IPv4 connection for many years, well before most consumer ISPs offered native IPv6. The service routes a customer's IPv6 traffic over a GRE-like tunnel back to Hurricane's network, then announces a /48 IPv6 prefix from AS6939 on the tunnel user's behalf. The implication for IP attribution is significant: IPv6 traffic from a tunnelbroker.net user appears to originate from AS6939 even though the physical underlying IPv4 connection may be on a completely unrelated ISP.

The Cogent IPv6 peering dispute from the HE side

The peering dispute between Hurricane Electric and Cogent over IPv6 interconnection is one of the longest-running unresolved peering standoffs in the global internet. From Hurricane's side the dispute centers on Cogent's demand for settlement-paid peering terms that Hurricane has consistently declined to accept, arguing that IPv6 reachability between two Tier 1 operators of comparable IPv6 prefix scale should be settlement-free as a matter of internet-routing hygiene. The dispute has persisted for many years without resolution despite multiple attempts at industry mediation.

The operational consequence is that single-homed AS6939 customers and single-homed AS174 customers have difficulty reaching each other directly on IPv6, requiring a third-party transit path for end-to-end reachability. From the AS6939 side this is one of the most-cited examples of Hurricane's role in the global IPv6 ecosystem: the company has chosen reachability- policy consistency over a commercial peering concession, accepting the IPv4-versus-IPv6 asymmetry in the routing graph as a cost of the position. Most major content providers and hyperscalers maintain transit on both networks to bridge the gap.

Free peering policy and the open-network model

Hurricane Electric maintains one of the most open peering policies of any Tier 1 backbone, accepting settlement-free peering with essentially any network that requests it on reasonable technical terms. The policy includes free peering at internet exchange points (IXPs) and at private network interconnects where technically practical. The open-peering posture is structurally why AS6939 has such a large customer cone — networks that cannot meet Cogent's or some other Tier 1 operators' peering requirements often peer with Hurricane instead, giving Hurricane a broader range of direct interconnections relative to the company's revenue size.

The open-peering combined with the IPv6 advocacy and the wide IXP participation makes AS6939 a recurring presence in the global interconnection fabric. For attribution work the implication is that AS6939 routes can appear in unexpected paths between operators that would not otherwise share direct connectivity, and traceroute analysis through AS6939 commonly traverses IXP-side interconnects rather than transit upstream paths.

Bird's Eye, the BGP looking glass, and HE.net tools

Hurricane Electric operates one of the most widely-used public BGP looking glasses at bgp.he.net, providing free public access to detailed BGP routing data, ASN information, prefix lookups, IPv6 deployment statistics, and historical routing changes. The tool has become a standard reference for operator investigations and IP-attribution research, and it is one of the more recognized public-internet operator services outside the commercial product portfolio. The company also operates a public IPv6 certification program that has trained thousands of network engineers on IPv6 fundamentals over the years.

For attribution and investigation work the he.net tooling is often the first lookup destination when researching an unknown IP or ASN. The free public service has been continuously maintained for many years and is one of the most reliable sources of BGP routing information available without commercial subscription. The same network that offers the tooling also operates the underlying transit network being investigated, which is a useful alignment when researching AS6939-related questions specifically.

Hostname conventions and the he.net signature

Hurricane Electric backbone-router hostnames follow a recognizable convention on the he.net domain. Typical hostnames take the form 10ge2-1.core1.fra1.he.net or 100ge9-2.core1.lax2.he.net encoding the interface speed and number, the core router identifier, and the three-letter city code (fra for Frankfurt, lax for Los Angeles, ams for Amsterdam, etc.). The he.net PTR signature is one of the cleanest Tier 1 backbone identifiers available in any traceroute data set, and it has been stable for many years.

Customer-issued IP space announced through AS6939 typically uses customer-managed reverse DNS rather than he.net hostnames, so the PTR signature is specific to Hurricane-owned infrastructure. The colocation and dedicated- server hosting business in Fremont also produces a recognizable set of he.net PTRs on the hosting-customer side, particularly for long-standing tenants in the Fremont 2 data center who have not configured custom reverse DNS.

Downstream-customer attribution and the tunnel-broker complication

AS6939 attribution has two distinct downstream populations to consider. First, the traditional wholesale-transit customer base of regional ISPs, hosting providers, content companies, and enterprise networks, with the standard backbone-versus-prefix attribution distinction shared with every Tier 1 operator. Second, the substantially smaller but operationally distinctive tunnelbroker.net population of individual users whose IPv6 traffic transits AS6939 over an IPv4 tunnel from elsewhere on the internet.

The tunnel-broker population complicates IPv6 attribution in a way that does not apply to most other Tier 1 networks. An IPv6 packet sourced from a Hurricane Electric tunnelbroker.net /48 prefix may have nothing to do with the user's physical access ISP and may originate from any IPv4-connected network in the world. For per-IP attribution on AS6939 IPv6 ranges, recognizing the tunnelbroker subset versus the customer-transit subset is the most useful distinction available from public data. The tunnelbroker prefixes are documented and can be filtered explicitly in attribution analysis.

Colocation, dedicated servers, and the Fremont 2 data center

Beyond IP transit, Hurricane Electric operates colocation and dedicated-server hosting from its Fremont, California facilities. The Fremont 2 data center is one of the longest-running Silicon Valley colocation venues and hosts a diverse set of long-term tenants ranging from small operators and hobbyist projects to enterprise customers and infrastructure providers. The dedicated-server product line is positioned at the affordable end of the dedicated-hosting market and has been used extensively by independent operators, open- source project infrastructure hosts, and small technology companies that value the fixed-pricing predictability of Hurricane's service.

The colocation and hosting business produces a recognizable population of AS6939-tagged IPs that map to specific tenants in Fremont rather than to backbone transit infrastructure. For attribution work the implication is that some AS6939 IPs represent end-user-facing hosted services with their own application characteristics, not transit-only flows. Pair an ASN lookup with reverse DNS and TLS-fingerprint checks to distinguish hosted-service AS6939 IPs from transit-customer prefixes.

Investigation pitfalls specific to Hurricane Electric IPs

Several attribution traps recur with AS6939 IPs. First, the tunnelbroker.net service means AS6939-attributed IPv6 traffic may originate from any IPv4 underlay network in the world, breaking the standard assumption that the IPv6 source ASN tells you the user's access ISP. Second, AS6939's downstream-customer cone is large despite the company's relatively modest corporate size, and the upstream-backbone label rarely identifies the operational owner of a specific prefix.

Third, the unresolved Cogent IPv6 dispute means IPv6 reachability through AS6939 is structurally different from IPv4 reachability through AS6939 — single-homed AS6939 customers may have reduced IPv6 reach to single-homed AS174 destinations. Fourth, the open peering policy means AS6939 appears in routing paths between operators that might not otherwise share direct connectivity, and AS6939 hop presence in a traceroute is not by itself evidence of Hurricane affiliation by source or destination. Fifth, Hurricane's free IPv6 certification, IPv6 evangelism, and BGP-tooling positioning give the network a public profile that exceeds its raw commercial scale — operationally treating AS6939 as a small regional ISP would underweight its actual global routing impact significantly.

Quick reference summary

Hurricane Electric is a Fremont-based independent Tier 1 internet backbone and hosting operator with one of the largest IPv4 prefix counts and broadest IPv6 reach of any global network. AS6939 ranks consistently at or near the top of CAIDA AS-rank measures by customer-cone size despite the company's modest revenue scale. The he.net PTR domain identifies Hurricane-owned backbone routers, and the bgp.he.net public looking glass is one of the most-used public-internet operator tools.

The tunnelbroker.net IPv6 service complicates AS6939 IPv6 attribution by introducing tunnel- broker prefixes whose underlying IPv4 path may be on any global network. The unresolved Cogent IPv6 peering dispute remains a structural reachability constraint for IPv6 single-transit architectures using AS6939 only. For per-IP attribution, pair an ASN lookup with a WHOIS lookup at the prefix level to identify whether an AS6939 IP is a Hurricane infrastructure address, a downstream customer prefix, or a tunnelbroker.net user prefix before drawing conclusions about physical location or access-network operator.

The combination of large IPv4 prefix count, broad IPv6 reach, open peering, tunnel-broker service, and public BGP tooling gives Hurricane Electric a global structural influence that is disproportionate to its corporate size, and the ASN deserves careful attention in any IP-attribution workflow that needs accurate operator classification. The Cogent dispute is the single most operationally consequential ongoing peering disagreement in the public IPv6 internet, and the existence of that dispute remains one of the most useful pieces of context for interpreting AS6939 routing decisions when they appear in any cross-network analysis. For abuse and operational workflows the Hurricane Electric network operations center publishes contact information for AS6939 backbone issues, while tunnelbroker.net abuse goes through the dedicated tunnel-broker support pipeline rather than through the general-transit channel. Recognize that two distinct abuse-handling paths exist for AS6939 depending on whether the offending traffic originates from a transit customer prefix or from a tunnel-broker user prefix, and routing the complaint to the correct workflow produces faster resolution than treating the network as a single undifferentiated operator at the abuse- handling layer or in operational ticketing workflows across the IP transit and tunnel-broker service lines.