Searching Whois Using a CLI

Using Command-Line Interface (CLI) Clients with Whois

The information provided on this page for Whois search functions, command syntax, flags, and examples only applies to ARIN’s Whois, and not Whois services provided by any other entity.

You can access ARIN’s Whois information by connecting to a Whois server using CLI commands entered into a terminal window. The following sections provide instructions for accessing ARIN’s Whois using the CLI.

This method uses the port 43 Whois. The following instructions are specific to ARIN and will not work for other RIRs or domain registries.

To use Whois from a terminal window, enter your query from the CLI. You can use different flags to restrict your search or display specific output.

Note: Depending on your operating system and terminal program, you may need to enter commands slightly differently. For example, when using Apple OS, you need to surround flags and search terms with quotes, and separate each type of flag with quotes. Quotes are not needed when using UNIX terminals.

Submitting a Whois Query from a Terminal

To submit a Whois query from a terminal, enter:

whois -h whois.arin.net “flag search-term”

diagram of parts of a whois command

The parts of this command are:

  • whois: the command itself
  • -h: specifies that the hostname of the Whois server will follow
  • whois.arin.net: the name of ARIN’s Whois server
  • flag: narrows the search by restricting the results to those that match criteria designated by the flag (see the following table)
  • search-term: the information for which you are searching

Using Flags

You may use flags with the query to narrow down the search criteria. Depending on the terminal client, you may not have to include quotes around the flag and/or search term. If you do not include a flag, the Whois server attempts to guess what information you are looking for and parses the query.

The flags to restrict the records are listed in the following table. Flags must be separated from each other and from the search term by a space. You can only use one flag of each type in a query (for example, one record type, one attribute, or one display flag).

Query Flags

In this table, all examples assume that the user is on a Mac and entering commands within the terminal app window.

Flag Type Description Formatting Example
n Record Type Searches for the specified network address space. whois -h whois.arin.net “n 198.51.100.0”
r Record Type Searches for the specified network address space in CIDR notation. If a hierarchy (<, >, or =) is not used, the Whois server attempts to guess the range of results desired. whois -h whois.arin.net “r = 198.51.100.0/24”
whois -h whois.arin.net “r > 198.18.0.0/15” “r < 198.51.100.0/24”
d Record Type Searches for the delegation name (information that is entered when configuring Reverse DNS). whois -h whois.arin.net “d 28.4.199.in-addr.arpa.”
a Record Type Searches for the specified ASN. whois -h whois.arin.net “a 26299”
p Record Type Searches for the specified POCs. For example, the query at right searches for POCs with the name Smith. whois -h whois.arin.net “p smith”
o Record Type Searches for the specified organization. whois -h whois.arin.net “o *Philadelphia*”
c Record Type Searches for the specified end user customer. If you know the customer ID, you can use it with the customer query to narrow down results and display information for only that customer (see 2nd example). whois -h whois.arin.net “c arin”
whois -h whois.arin.net “c C02366807”
e Record Type Searches for the specified POC, organizations, and end user customers. whois -h whois.arin.net “e icann”
z Record Type Searches the database with all of the previously-listed flags (n, r, d, a, p, o, c, and e). whois -h whois.arin.net “z icann”
@ domain-name Record Attribute Limits the query results to those containing the specified domain name in an email address. For example, the query at right searches for the domain name arin.net in the POC, organizations, and end user customers. whois -h whois.arin.net “e @ arin.net”
! handle Record Attribute Limits the query results to those containing the specified handle or identifier of the POC. Searching for the handle can deliver more accurate results than an email or name search. For example, the query at right searches for the organization named ICANN with a handle containing IANA. whois -h whois.arin.net “o icann ! iana”
/ name Record Attribute Limits the query results to those containing the specified name. whois -h whois.arin.net “n / IANA-V6-RESERVE2”
. name Record Attribute This flag has the same function as the / name flag, but can be used when performing searches on Whois clients that do not work well with / name.
Output Flags

Searches that retrieve a single record will display the full record. Searches that retrieve more than one record will be displayed in list output. You can use the + and - flags to modify the output if a query retrieves more than one record.

Flag Description Formatting Example
+ Using this flag in the query requires that full output is displayed with detailed information for each match. whois -h whois.arin.net “+ n / TEST-NET-1”
- Using this flag in the query requires that list output is displayed with summary information only (even if a single record is returned). whois -h whois.arin.net “e - icann”
Record Hierarchy Flags

Records in ARIN’s Whois have hierarchical relationships with other records. For example, a network can have parent networks and child networks. To display those related records, use the flags described as follows.

Note: The + flag cannot be used with these flags.

Flag Description Formatting Example
< Displays the record related moving up the hierarchy. For a network, displays the supernet, or parent network, in detailed format. whois -h whois.arin.net “n < 198.51.100.55”
> Displays the record related moving down the hierarchy. For a network, displays the subdelegations, or subnets below the network, in list format. For an organization or customer, displays the resources registered to that organization or customer, in list format. whois -h whois.arin.net “n > 192.0.0.0”
= Displays only an exact match in the hierarchy.

Using Wildcards

To perform a wildcard query, substitute an asterisk (*) for the alphanumeric characters that you want to leave off the end of the query term. For example, this query performs a search for POCs beginning with or equal to North, and would also return results with Northcutt, Northington, Northrup, etc.:

whois -h whois.arin.net “p north*”

Wildcards can be used with any other flags.

Interpreting Whois Results

Results for Whois queries performed using the ARIN website or the command-line interface contain information about IPv4 and IPv6 address space, ASNs, POCs, and Orgs. Depending on the query options chosen or query flags used, the fields shown in the following tables may or may not be displayed in the result. Some fields appear in results from multiple query types; these are listed in the Common Fields Found on Multiple Record Types section.

Network Information

Network records (NETs) define a range of IPv4 or IPv6 addresses and show the organizations and POCs with authority over them.

Result Field Description
NetRange IP address range of a network resource.
CIDR The IP address specified in CIDR notation.
NetName Name given to the network by the organization.
NetHandle A unique auto-generated handle that identifies the network in ARIN’s database. It cannot be changed.
Parent The NetName and NetHandle of the parent IP address range.
NetType The type of network: Direct Allocation (ISP), Direct Assignment (End user), Reallocated (downstream ISP customer), Reassigned (end user customer)
Origin AS Optional field collected during all IPv4 and IPv6 block transactions that records a list of the Autonomous System Numbers (ASNs), separated by commas or whitespace, from which the addresses in the address block(s) may originate.

Organization Information

Organization information includes the Org ID to which resources are registered and the contact information for the Org POCs.

Result Field Description
Organization/OrgName The name of the Organization who is assigned the resource(s)
OrgId A unique auto-generated name that identifies the organization in ARIN’s database. It cannot be changed.
AdminHandle A unique auto-generated handle that identifies the Admin POC for this org in ARIN’s database. It cannot be changed.
AdminName Name of the Admin POC for the org.
AdminPhone, AdminEmail Phone number and email address for the Admin POC for the org.
TechHandle A unique auto-generated handle that identifies the Tech POC for this org in ARIN’s database. It cannot be changed.
TechName Name of the Tech POC who manages the org.
TechPhone, TechEmail Phone number and email address for the Tech POC for the org.
AbuseHandle A unique auto-generated name that identifies the handle of the Abuse POC for this org in ARIN’s database. It cannot be changed.
AbuseName Name of the contact for the reporting and resolution of network abuse issues.
AbusePhone, AbuseEmail Phone number and email address for the Abuse POC for the org.

ASN Information

ASN records, much like NET records, display the specific ASN and the Org with authority over it.

Result Field Description
ASNumber Displays the number that represents an autonomous system—networks or connected groups of networks that adhere to a single unique routing policy that differs from the routing policies of their border peers.
ASName Name given to the ASN by the organization.
ASHandle Number used to identify the AS in the ARIN database. Typically consists of the prefix AS and the AS number (for example, AS26299).

Point of Contact

POC information provides a name, mailing address, and contact information, and lists any organizations or resources over which the POC has authority.

Result Field Description
Name The name of the POC.
Handle A unique auto-generated handle that identifies the POC in ARIN’s database. It cannot be changed.
Company Company for which the person is the POC.

Delegation/Reverse DNS

Delegations are entries that relate IP addresses to domain names using the Domain Name System (DNS) of the Internet. Delegations contain the information necessary for Reverse DNS, including the associated nameservers, and DNS Delegation Signer (DS Record) information.

Result Field Description
Name The name of the POC.
NameServer The name of one or more nameservers for a domain object. There can be multiple nameservers shown.

Common Fields Found on Multiple Record Types

These fields may display in the results of multiple types of queries.

Result Field Description
Address, City, StateProv, PostalCode, Country Typically the location information for a resource, an organization, or POC. May not always reflect the exact physical location of the actual resource, org, or POC, as there is no policy requirement to do so.
RegDate Date that the resource was initially registered in the ARIN database.
Updated Date that the registration record was last updated.
Comments Text comment that applies to the resource. There can be multiple Comment fields displayed in a result. These comments are typically added by an organization POC. Comments can include: Customer comments, Org comments, Resource comments, POC comments
Ref URL of the information as it appears in ARIN’s database. It can have a prefix appended to indicate the type of reference. For example, this is a URL for the Org Tech POC that is shown in a result: OrgTechRef: https://whois.arin.net/rest/poc/IANA-IP-ARIN

Getting Help with Whois

  • For operational problems with Whois, please log in to your ARIN Online account and create an Ask ARIN ticket, or contact the ARIN Help Desk with the appropriate details.
  • To report inaccurate information in Whois, you can file a report online.