Quick Guide to ARIN's Whois
On this page…
Whois is a query and response protocol that is used for querying databases that store registered users or assignees of an Internet resource, such as IP addresses or domain names.
ARIN's Whois service allows a user to retrieve information about IP number resources, organizations, and Points of Contact (POCs) registered with ARIN. It pulls this information directly from ARIN’s database, which contains IPv4 and IPv6 addresses, Autonomous System Numbers (ASNs), organizations, customer reassignments, and related POCs.
Note: Some types of information (such as domain information) are not provided by ARIN’s Whois service, but may be available from other Whois services.
There are different ways to get information from Whois, including:
- Web interfaces: ARIN and others provide Whois web interfaces. ARIN provides simple and advanced Whois search capabilities in a search section on our web site.
- Application Programming Interfaces:
- ARIN provides a Whois-RESTful Web Service (Whois-RWS) that allows developers to create their own applications or scripts that retrieve information using Whois-RWS.
- The IETF has standardized a RESTful Whois API called Registration Data Access Protocol (RDAP) that is supported by all Regional Internet Registries (RIRs), including ARIN. More information is available on the RDAP page.
- Command-Line Interface (CLI) clients: You can access Whois information by connecting to a Whois server using CLI commands entered into a terminal window. ARIN’s Whois service is available through the CLI. This page provides instructions for using the CLI method of Whois.
Each RIR maintains its own Whois service for the region that it covers. ARIN’s Whois contains detailed information only about the resources that ARIN manages. However, it also provides reference records for IP address ranges and ASNs associated with other RIRs, including AFRINIC (Africa), APNIC (Asia Pacific Region), LACNIC (Latin America), and RIPE NCC (Europe, Middle East, and parts of Asia), but does not include information on delegations below the RIR level for these ranges. To get more detailed information about resources registered in other regions, you will need to connect to that region’s Whois server.
Also note that the information provided on this site for Whois command syntax, flags, and examples only applies to ARIN’s Whois service.
To use Whois from a terminal window, enter your query from the CLI. You can use different flags to restrict your search or display specific output.
Note: Depending on your operating system and terminal program, you may need to enter commands slightly differently. For example, when using Apple OS, you need to surround flags and search terms with quotes, and separate each type of flag with quotes. Quotes are not needed when using UNIX terminals.
To submit a Whois query from a terminal, enter:
whois -h whois.arin.net “flag search-term”
The parts of this command are:
- whois: the command itself
- -h: specifies that the hostname of the Whois server will follow
- whois.arin.net: the name of ARIN’s Whois server
- flag: narrows the search by restricting the results to those that match criteria designated by the flag (see the following table)
- search-term: the information for which you are searching
You may use flags with the query to narrow down the search criteria. Depending on the terminal client, you may not have to include quotes around the flag and/or search term. If you do not include a flag, the Whois server attempts to guess what information you are looking for and parses the query.
The flags to restrict the records are listed in the following table. Flags must be separated from each other and from the search term by a space. You can only use one flag of each type in a query (for example, one record type, one attribute, or one display flag).
In this table, all examples assume that the user is on a Mac and entering commands within the terminal app window.
Searches for the specified network address space.
|whois -h whois.arin.net “n 198.51.100.0”|
|r||Record Type||Searches for the specified network address space in CIDR notation. If a hierarchy (<, >, or =) is not used, the Whois server attempts to guess the range of results desired.||
whois -h whois.arin.net “r = 198.51.100.0/24”
whois -h whois.arin.net “r > 198.18.0.0/15” “r < 198.51.100.0/24”
|d||Record Type||Searches for the delegation name (information that is entered when configuring Reverse DNS).||whois -h whois.arin.net "d 28.4.199.in-addr.arpa."|
|a||Record Type||Searches for the specified ASN.||whois -h whois.arin.net “a 26299”|
Searches for the specified Points of Contact (POCs). For example, the query at right searches for POCs with the name Smith.
whois -h whois.arin.net “p smith”
|o||Record Type||Searches for the specified organization.||whois -h whois.arin.net “o *Philadelphia*”|
|c||Record Type||Searches for the specified end user customer. If you know the customer ID, you can use it with the customer query to narrow down results and display information for only that customer (see 2nd example).||
whois -h whois.arin.net “c arin”whois -h whois.arin.net "c C02366807"
|e||Record Type||Searches for the specified POC, organizations, and end user customers.||
whois -h whois.arin.net "e icann"
|z||Record Type||Searches the database with all of the previously-listed flags (n, r, d, a, p, o, c, and e).||whois -h whois.arin.net “z icann”|
|@ domain-name||Record Attribute||Limits the query results to those containing the specified domain name in an email address. For example, the query at right searches for the domain name arin.net in the POC, organizations, and end user customers.||whois -h whois.arin.net “e @ arin.net”|
|! handle||Record Attribute||Limits the query results to those containing the specified handle or identifier of the POC. Searching for the handle can deliver more accurate results than an email or name search. For example, the query at right searches for the organization named ICANN with a handle containing IANA.||whois -h whois.arin.net “o icann ! iana”|
|/ name||Record Attribute||Limits the query results to those containing the specified name.||whois -h whois.arin.net "n / IANA-V6-RESERVE2"|
|. name||Record Attribute||This flag has the same function as the / name flag, but can be used when performing searches on Whois clients that do not work well with / name.|
Searches that retrieve a single record will display the full record. Searches that retrieve more than one record will be displayed in list output. You can use the + and - flags to modify the output if a query retrieves more than one record.
Using this flag in the query requires that full output is displayed with detailed information for each match.
|whois -h whois.arin.net "+ n / TEST-NET-1"|
|-||Using this flag in the query requires that list output is displayed with summary information only (even if a single record is returned).||
whois -h whois.arin.net "e - icann"
Records in ARIN’s Whois have hierarchical relationships with other records. For example, a network can have parent networks and child networks. To display those related records, use the flags described as follows. (Note: The + flag cannot be used with these flags.)
Displays the record related moving up the hierarchy. For a network, displays the supernet, or parent network, in detailed format.
|whois -h whois.arin.net "n < 198.51.100.55"|
|>||Displays the record related moving down the hierarchy. For a network, displays the subdelegations, or subnets below the network, in list format. For an organization or customer, displays the resources registered to that organization or customer, in list format.||
whois -h whois.arin.net "n > 192.0.0.0"
|=||Displays only an exact match in the hierarchy.||
To perform a wildcard query, substitute an asterisk (*) for the alphanumeric characters that you want to leave off the end of the query term. For example, this query performs a search for POCs beginning with or equal to North, and would also return results with Northcutt, Northington, Northrup, etc.:
whois -h whois.arin.net “p north*”
Wildcards can be used with any other flags.
- To guarantee matching only a single record, look it up by its handle using a handle-only search. In the record summary line, the handle is shown in parentheses after the name.
- When using a handle to conduct a search for POC information, be sure to add the -ARIN extension.
- Queries that return more than 256 results will stop displaying data after the limit has been reached for each record type. You may want to narrow your search criteria or add flags to your query to limit the results.
- To search on an individual's name, you can enter the last name, or to further restrict results, use the last name and first name, separated by a comma. (For example: Smith, John.)
Results for Whois queries performed using the ARIN website or the command-line interface contain information about IPv4 and IPv6 address space, ASNs, POCs, and Orgs. Depending on the flags used in the query, the fields shown in the tables below may or may not be displayed in the result. Some fields appear in results from multiple query types; these are listed in the “Common Fields” section.
Network records (NETs) define a range of IPv4 or IPv6 addresses and show the organizations and POCs with authority over them.
|NetRange||IP address range of a network resource.|
|CIDR||The IP address specified in CIDR notation.|
|NetName||Name given to the network by the organization.|
|NetHandle||A unique auto-generated handle that identifies the network in ARIN’s database. It cannot be changed.|
|Parent||The NetName and NetHandle of the parent IP address range.|
|NetType||The type of network:
|Origin AS||Optional field collected during all IPv4 and IPv6 block transactions that records a list of the Autonomous System Numbers (ASNs), separated by commas or whitespace, from which the addresses in the address block(s) may originate.|
Organization information includes the Org ID to which resources are registered and the contact information for the Org POCs.
|Organization/OrgName||The name of the Organization who is assigned the resource(s)|
|OrgId||A unique auto-generated name that identifies the organization in ARIN’s database. It cannot be changed.|
|AdminHandle||A unique auto-generated handle that identifies the Admin POC for this org in ARIN’s database. It cannot be changed.|
|AdminName||Name of the Admin POC for the org.|
|AdminPhone, AdminEmail||Phone number and email address for the Admin POC for the org.|
|TechHandle||A unique auto-generated handle that identifies the Tech POC for this org in ARIN’s database. It cannot be changed.|
|TechName||Name of the Tech POC who manages the org.|
|TechPhone, TechEmail||Phone number and email address for the Tech POC for the org.|
|AbuseHandle||A unique auto-generated name that identifies the handle of the Abuse POC for this org in ARIN’s database. It cannot be changed.|
|AbuseName||Name of the contact for the reporting and resolution of network abuse issues.|
|AbusePhone, AbuseEmail||Phone number and email address for the Abuse POC for the org.|
ASN records, much like NET records, display the specific ASN and the Org with authority over it.
|ASNumber||Displays the number that represents an autonomous system—networks or connected groups of networks that adhere to a single unique routing policy that differs from the routing policies of their border peers.|
|ASName||Name given to the ASN by the organization.|
|ASHandle||Number used to identify the AS in the ARIN database. Typically consists of the prefix AS and the AS number (for example, AS26299).|
Point of Contact
POC information provides a name, mailing address, and contact information, and lists any organizations or resources over which the POC has authority.
|Name||The name of the POC.|
|Handle||A unique auto-generated handle that identifies the POC in ARIN’s database. It cannot be changed.|
|Company||Company for which the person is the POC.|
Delegations are entries that relate IP addresses to domain names using the Domain Name System (DNS) of the Internet. Delegations contain the information necessary for Reverse DNS, including the associated nameservers, and DNS Delegation Signer (DS Record) information.
|Name||The name of the POC.|
|NameServer||The name of one or more nameservers for a domain object. There can be multiple nameservers shown.|
Common Fields Found on Multiple Record Types
These fields may display in the results of multiple types of queries.
|Address, City, StateProv, PostalCode, Country||Typically the location information for a resource, an organization, or POC. May not always reflect the exact physical location of the actual resource, org, or POC, as there is no policy requirement to do so.|
|RegDate||Date that the resource was initially registered in the ARIN database.|
|Updated||Date that the registration record was last updated.|
|Comments||Text comment that applies to the resource. There can be multiple Comment fields displayed in a result. These comments are typically added by an organization POC. Comments can include:
|Ref||URL of the information as it appears in ARIN’s database. It can have a prefix appended to indicate the type of reference. For example, this is a URL for the Org Tech POC that is shown in a result:
Search Related Content
- Quick Guide to ARIN's Whois
- Bulk Whois
- Whois Inaccuracy Reporting
- Registry Data Access Protocol (RDAP)
- Number Resource Fraud Reporting
- Provisioning & Maintenance of Registration Records (Reg-RWS)
- Resource Public Key Infrastructure (RPKI)
- CIDR Calculator
- Routing Registry
- Software Repository