Searching Whois Using a CLI
Using Command-Line Interface (CLI) Clients with Whois-RWS
The information provided on this site for Whois search functions, command syntax, flags, and examples only applies to ARIN’s Whois-RWS services and not Whois services provided by any other entity.
You can access ARIN’s Whois-RWS information by connecting to a Whois server using CLI commands entered into a terminal window. The following sections provide instructions for accessing ARIN’s Whois-RWS using the CLI.
This method uses the port 43 Whois. The following instructions are specific to ARIN and will not work for other RIRs or domain registries.
To use Whois from a terminal window, enter your query from the CLI. You can use different flags to restrict your search or display specific output.
Note: Depending on your operating system and terminal program, you may need to enter commands slightly differently. For example, when using Apple OS, you need to surround flags and search terms with quotes, and separate each type of flag with quotes. Quotes are not needed when using UNIX terminals.
Submitting a Whois Query from a Terminal
To submit a Whois query from a terminal, enter:
whois -h whois.arin.net “flag search-term”
The parts of this command are:
whois: the command itself
-h: specifies that the hostname of the Whois server will follow
whois.arin.net: the name of ARIN’s Whois server
flag: narrows the search by restricting the results to those that match criteria designated by the flag (see the following table)
search-term: the information for which you are searching
You may use flags with the query to narrow down the search criteria. Depending on the terminal client, you may not have to include quotes around the flag and/or search term. If you do not include a flag, the Whois server attempts to guess what information you are looking for and parses the query.
The flags to restrict the records are listed in the following table. Flags must be separated from each other and from the search term by a space. You can only use one flag of each type in a query (for example, one record type, one attribute, or one display flag).
In this table, all examples assume that the user is on a Mac and entering commands within the terminal app window.
|n||Record Type||Searches for the specified network address space.||whois -h whois.arin.net “n 198.51.100.0”|
|r||Record Type||Searches for the specified network address space in CIDR notation. If a hierarchy (<, >, or =) is not used, the Whois server attempts to guess the range of results desired.||whois -h whois.arin.net “r = 198.51.100.0/24”
whois -h whois.arin.net “r > 198.18.0.0/15” “r < 198.51.100.0/24”
|d||Record Type||Searches for the delegation name (information that is entered when configuring Reverse DNS).||whois -h whois.arin.net “d 28.4.199.in-addr.arpa.”|
|a||Record Type||Searches for the specified ASN.||whois -h whois.arin.net “a 26299”|
|p||Record Type||Searches for the specified POCs. For example, the query at right searches for POCs with the name Smith.||whois -h whois.arin.net “p smith”|
|o||Record Type||Searches for the specified organization.||whois -h whois.arin.net “o *Philadelphia*”|
|c||Record Type||Searches for the specified end user customer. If you know the customer ID, you can use it with the customer query to narrow down results and display information for only that customer (see 2nd example).||whois -h whois.arin.net “c arin”
whois -h whois.arin.net “c C02366807”
|e||Record Type||Searches for the specified POC, organizations, and end user customers.||whois -h whois.arin.net “e icann”|
|z||Record Type||Searches the database with all of the previously-listed flags (n, r, d, a, p, o, c, and e).||whois -h whois.arin.net “z icann”|
|@ domain-name||Record Attribute||Limits the query results to those containing the specified domain name in an email address. For example, the query at right searches for the domain name arin.net in the POC, organizations, and end user customers.||whois -h whois.arin.net “e @ arin.net”|
|! handle||Record Attribute||Limits the query results to those containing the specified handle or identifier of the POC. Searching for the handle can deliver more accurate results than an email or name search. For example, the query at right searches for the organization named ICANN with a handle containing IANA.||whois -h whois.arin.net “o icann ! iana”|
|/ name||Record Attribute||Limits the query results to those containing the specified name.||whois -h whois.arin.net “n / IANA-V6-RESERVE2”|
|. name||Record Attribute||This flag has the same function as the
Searches that retrieve a single record will display the full record. Searches that retrieve more than one record will be displayed in list output. You can use the + and - flags to modify the output if a query retrieves more than one record.
|+||Using this flag in the query requires that full output is displayed with detailed information for each match.||whois -h whois.arin.net “+ n / TEST-NET-1”|
|-||Using this flag in the query requires that list output is displayed with summary information only (even if a single record is returned).||whois -h whois.arin.net “e - icann”|
Record Hierarchy Flags
Records in ARIN’s Whois have hierarchical relationships with other records. For example, a network can have parent networks and child networks. To display those related records, use the flags described as follows.
Note: The + flag cannot be used with these flags.
|<||Displays the record related moving up the hierarchy. For a network, displays the supernet, or parent network, in detailed format.||whois -h whois.arin.net “n < 198.51.100.55”|
|>||Displays the record related moving down the hierarchy. For a network, displays the subdelegations, or subnets below the network, in list format. For an organization or customer, displays the resources registered to that organization or customer, in list format.||whois -h whois.arin.net “n > 192.0.0.0”|
|=||Displays only an exact match in the hierarchy.|
To perform a wildcard query, substitute an asterisk (*) for the alphanumeric characters that you want to leave off the end of the query term. For example, this query performs a search for POCs beginning with or equal to North, and would also return results with Northcutt, Northington, Northrup, etc.:
whois -h whois.arin.net “p north*”
Wildcards can be used with any other flags.
Interpreting Whois Results
Results for Whois queries performed using the ARIN website or the command-line interface contain information about IPv4 and IPv6 address space, ASNs, POCs, and Orgs. Visit Interpreting Whois Results.