Using Command-Line Interface (CLI) Clients with Whois
The information provided on this page for Whois search functions, command syntax, flags, and examples only applies to ARIN’s Whois, and not Whois services provided by any other entity.
You can access ARIN’s Whois information by connecting to a Whois server using CLI commands entered into a terminal window. The following sections provide instructions for accessing ARIN’s Whois using the CLI.
This method uses the port 43 Whois. The following instructions are specific to ARIN and will not work for other RIRs or domain registries.
To use Whois from a terminal window, enter your query from the CLI. You can use different flags to restrict your search or display specific output.
Note: Depending on your operating system and terminal program, you may need to enter commands slightly differently. For example, when using Apple OS, you need to surround flags and search terms with quotes, and separate each type of flag with quotes. Quotes are not needed when using UNIX terminals.
Submitting a Whois Query from a Terminal
To submit a Whois query from a terminal, enter:
whois -h whois.arin.net “flag search-term”
The parts of this command are:
whois: the command itself-h: specifies that the hostname of the Whois server will followwhois.arin.net: the name of ARIN’s Whois serverflag: narrows the search by restricting the results to those that match criteria designated by the flag (see the following table)search-term: the information for which you are searching
Using Flags
You may use flags with the query to narrow down the search criteria. Depending on the terminal client, you may not have to include quotes around the flag and/or search term. If you do not include a flag, the Whois server attempts to guess what information you are looking for and parses the query.
The flags to restrict the records are listed in the following table. Flags must be separated from each other and from the search term by a space. You can only use one flag of each type in a query (for example, one record type, one attribute, or one display flag).
Query Flags
In this table, all examples assume that the user is on a Mac and entering commands within the terminal app window.
| Flag | Type | Description | Formatting Example |
|---|---|---|---|
| n | Record Type | Searches for the specified network address space. | whois -h whois.arin.net “n 198.51.100.0” |
| r | Record Type | Searches for the specified network address space in CIDR notation. If a hierarchy (<, >, or =) is not used, the Whois server attempts to guess the range of results desired. | whois -h whois.arin.net “r = 198.51.100.0/24” whois -h whois.arin.net “r > 198.18.0.0/15” “r < 198.51.100.0/24” |
| d | Record Type | Searches for the delegation name (information that is entered when configuring Reverse DNS). | whois -h whois.arin.net “d 28.4.199.in-addr.arpa.” |
| a | Record Type | Searches for the specified ASN. | whois -h whois.arin.net “a 26299” |
| p | Record Type | Searches for the specified POCs. For example, the query at right searches for POCs with the name Smith. | whois -h whois.arin.net “p smith” |
| o | Record Type | Searches for the specified organization. | whois -h whois.arin.net “o *Philadelphia*” |
| c | Record Type | Searches for the specified end user customer. If you know the customer ID, you can use it with the customer query to narrow down results and display information for only that customer (see 2nd example). | whois -h whois.arin.net “c arin” whois -h whois.arin.net “c C02366807” |
| e | Record Type | Searches for the specified POC, organizations, and end user customers. | whois -h whois.arin.net “e icann” |
| z | Record Type | Searches the database with all of the previously-listed flags (n, r, d, a, p, o, c, and e). | whois -h whois.arin.net “z icann” |
| @ domain-name | Record Attribute | Limits the query results to those containing the specified domain name in an email address. For example, the query at right searches for the domain name arin.net in the POC, organizations, and end user customers. | whois -h whois.arin.net “e @ arin.net” |
| ! handle | Record Attribute | Limits the query results to those containing the specified handle or identifier of the POC. Searching for the handle can deliver more accurate results than an email or name search. For example, the query at right searches for the organization named ICANN with a handle containing IANA. | whois -h whois.arin.net “o icann ! iana” |
| / name | Record Attribute | Limits the query results to those containing the specified name. | whois -h whois.arin.net “n / IANA-V6-RESERVE2” |
| . name | Record Attribute | This flag has the same function as the / name flag, but can be used when performing searches on Whois clients that do not work well with / name. |
Output Flags
Searches that retrieve a single record will display the full record. Searches that retrieve more than one record will be displayed in list output. You can use the + and - flags to modify the output if a query retrieves more than one record.
| Flag | Description | Formatting Example |
|---|---|---|
| + | Using this flag in the query requires that full output is displayed with detailed information for each match. | whois -h whois.arin.net “+ n / TEST-NET-1” |
| - | Using this flag in the query requires that list output is displayed with summary information only (even if a single record is returned). | whois -h whois.arin.net “e - icann” |
Record Hierarchy Flags
Records in ARIN’s Whois have hierarchical relationships with other records. For example, a network can have parent networks and child networks. To display those related records, use the flags described as follows.
Note: The + flag cannot be used with these flags.
| Flag | Description | Formatting Example |
|---|---|---|
| < | Displays the record related moving up the hierarchy. For a network, displays the supernet, or parent network, in detailed format. | whois -h whois.arin.net “n < 198.51.100.55” |
| > | Displays the record related moving down the hierarchy. For a network, displays the subdelegations, or subnets below the network, in list format. For an organization or customer, displays the resources issued to that organization or customer, in list format. | whois -h whois.arin.net “n > 192.0.0.0” |
| = | Displays only an exact match in the hierarchy. |
Using Wildcards
To perform a wildcard query, substitute an asterisk (*) for the alphanumeric characters that you want to leave off the end of the query term. For example, this query performs a search for POCs beginning with or equal to North, and would also return results with Northcutt, Northington, Northrup, etc.:
whois -h whois.arin.net “p north*”
Wildcards can be used with any other flags.
Interpreting Whois Results
Results for Whois queries performed using the ARIN website or the command-line interface contain information about IPv4 and IPv6 address space, ASNs, POCs, and Orgs. Depending on the query options chosen or query flags used, the fields shown in the following tables may or may not be displayed in the result. Some fields appear in results from multiple query types; these are listed in the Common Fields Found on Multiple Record Types section.
Network Information
Network records (NETs) define a range of IPv4 or IPv6 addresses and show the organizations and POCs with authority over them.
| Result Field | Description |
|---|---|
| NetRange | IP address range of a network resource. |
| CIDR | The IP address specified in CIDR notation. |
| NetName | Name given to the network by the organization. |
| NetHandle | A unique auto-generated handle that identifies the network in ARIN’s database. It cannot be changed. |
| Parent | The NetName and NetHandle of the parent IP address range. |
| NetType | The type of network: Direct Allocation (ISP), Direct Assignment (End user), Reallocated (downstream ISP customer), Reassigned (end user customer) |
| Origin AS | Optional field collected during all IPv4 and IPv6 block transactions that records a list of the Autonomous System Numbers (ASNs), separated by commas or whitespace, from which the addresses in the address block(s) may originate. |
Organization Information
Organization information includes the Org ID to which resources are issued and the contact information for the Org POCs.
| Result Field | Description |
|---|---|
| Organization/OrgName | The name of the Organization who is assigned the resource(s) |
| OrgId | A unique auto-generated name that identifies the organization in ARIN’s database. It cannot be changed. |
| AdminHandle | A unique auto-generated handle that identifies the Admin POC for this org in ARIN’s database. It cannot be changed. |
| AdminName | Name of the Admin POC for the org. |
| AdminPhone, AdminEmail | Phone number and email address for the Admin POC for the org. |
| TechHandle | A unique auto-generated handle that identifies the Tech POC for this org in ARIN’s database. It cannot be changed. |
| TechName | Name of the Tech POC who manages the org. |
| TechPhone, TechEmail | Phone number and email address for the Tech POC for the org. |
| AbuseHandle | A unique auto-generated name that identifies the handle of the Abuse POC for this org in ARIN’s database. It cannot be changed. |
| AbuseName | Name of the contact for the reporting and resolution of network abuse issues. |
| AbusePhone, AbuseEmail | Phone number and email address for the Abuse POC for the org. |
| RoutingHandle | A unique auto-generated name that identifies the handle of the Routing POC for this org in ARIN’s database. It cannot be changed. |
| RoutingName | Name of the contact responsible for routing registry and RPKI certification information for the organization. |
| RoutingPhone, RoutingEmail | Phone number and email address for the Routing POC for the org. |
| DNSHandle | A unique auto-generated name that identifies the handle of the DNS POC for this org in ARIN’s database. It cannot be changed. |
| DNSName | Name of the contact responsible for reverse DNS and secure DNS information for the organization. |
| DNSPhone, DNSEmail | Phone number and email address for the DNS POC for the org. |
ASN Information
ASN records, much like NET records, display the specific ASN and the Org with authority over it.
| Result Field | Description |
|---|---|
| ASNumber | Displays the number that represents an autonomous system—networks or connected groups of networks that adhere to a single unique routing policy that differs from the routing policies of their border peers. |
| ASName | Name given to the ASN by the organization. |
| ASHandle | Number used to identify the AS in the ARIN database. Typically consists of the prefix AS and the AS number (for example, AS26299). |
Point of Contact
POC information provides a name, mailing address, and contact information, and lists any organizations or resources over which the POC has authority.
| Result Field | Description |
|---|---|
| Name | The name of the POC. |
| Handle | A unique auto-generated handle that identifies the POC in ARIN’s database. It cannot be changed. |
| Company | Company for which the person is the POC. |
Delegation/Reverse DNS
Delegations are entries that relate IP addresses to domain names using the Domain Name System (DNS) of the Internet. Delegations contain the information necessary for Reverse DNS, including the associated nameservers, and DNS Delegation Signer (DS Record) information.
| Result Field | Description |
|---|---|
| Name | The name of the POC. |
| NameServer | The name of one or more nameservers for a domain object. There can be multiple nameservers shown. |
Common Fields Found on Multiple Record Types
These fields may display in the results of multiple types of queries.
| Result Field | Description |
|---|---|
| Address, City, StateProv, PostalCode, Country | Typically the location information for a resource, an organization, or POC. May not always reflect the exact physical location of the actual resource, org, or POC, as there is no policy requirement to do so. |
| RegDate | Date that the resource was initially registered in the ARIN database. |
| Updated | Date that the registration record was last updated. |
| Comments | Text comment that applies to the resource. There can be multiple Comment fields displayed in a result. These comments are typically added by an organization POC. Comments can include: Customer comments, Org comments, Resource comments, POC comments |
| Ref | URL of the information as it appears in ARIN’s database. It can have a prefix appended to indicate the type of reference. For example, this is a URL for the Org Tech POC that is shown in a result: OrgTechRef: https://whois.arin.net/rest/poc/IANA-IP-ARIN |
Getting Help with Whois
- For operational problems with Whois, please log in to your ARIN Online account and create an Ask ARIN ticket, or contact the ARIN Help Desk with the appropriate details.
- To report inaccurate information in Whois, you can file a report online.
