whois

[Christopher Browne]

On 1/24/06, Lennart Sorensen <lsorense-1wCw9BSqJbv44Nm34jS7GywD8/FfD2ys at public.gmane.org> wrote:
> On Mon, Jan 23, 2006 at 04:03:54PM -0800, nobrowser-Re5JQEeQqe8AvxtiuMwx3w at public.gmane.org wrote:
> > For the (web based) UI of our application, we'd like to display the Real
> > Life (TM) details of an organisation based on an IP address.  This is
> > what the whois service is for.  Unfortunately, what the whois server
> > actually replies with is not specified by any RFC or other standard that
> > I am aware of, and in practice the format is nearly free form.  That
> > would be OK if all we wanted to do was to show the first reply; but we
> > need to follow the referrals to other whois servers holding information
> > about suballocated blocks.  Our problem is, then, that the format of
> > these referrals also varies, and no existing software seems to cover all
> > of them.
> >
> > As an example, try this with the whois client in debian (by
> > md-k2GhghHVRtY at public.gmane.org):
> >
> > whois -h whois.arin.net 61.100.186.185
> >
> > you'll see that it correctly handled the first referral (from
> > whois.arin.net to whois.apnic.net) but missed the next which was buried
> > in this snippet:
> >
> > remarks:      This IP address space has been allocated to KRNIC.
> > remarks:      For more information, using KRNIC Whois Database
> > remarks:      whois -h whois.nic.or.kr
> >
> > Does anyone know of a general solution to this situation?
>
> The whois command on debian seems to know how to follow references for a
> very large number of whois systems.  It has certainly had to be updated
> once in a while, but it is very very nice to use.  Just doing whois
> 61.100.186.185 returns what to me looks like exactly the right
> information.
>
> Might be worth looking at how that version is implemented.
>
> Description: the GNU whois client
>  This is a new whois (RFC 3912) client rewritten from scratch.
>  It is inspired from and compatible with the usual BSD and RIPE whois(1)
>  programs.
>  It is intelligent and can automatically select the appropriate whois
>  server for most queries.

The trouble is that there are at least *three* things going on...

1.  The WHOIS RFC doesn't specify terribly much...

Merely that you connect to a server, on port 43, submit an object, and
expect to get a text content reply.

2.  The Debian whois client is, indeed, very nice in that it knows
that a whole lot of TLDs exist, and, for many (not all) of them, what
server will provide relevant WHOIS results.  It's my favorite whois
client for this reason...

3.  As there is no standardization of the output, you can expect to
get varying results from different WHOIS servers servicing different
TLDs.  This is actually quite legitimate in view of the fact that
different TLDs have different sets of policies...
--
http://www3.sympatico.ca/cbbrowne/linux.html
"The true  measure of a  man is how he treats  someone who can  do him
absolutely no good." -- Samuel Johnson, lexicographer (1709-1784)
--
The Toronto Linux Users Group.      Meetings: http://tlug.ss.org
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml