Your IP address could not be determined at this time.

Documentation of Differences Between Whois-RWS and Legacy Whois

Introduction

ARIN’s Directory Service for registration data has used the NICNAME/WHOIS protocol since its inception. The limitations of the NICNAME/WHOIS protocol are well known and documented in RFC3912. In essence, the NICNAME/WHOIS protocol does not specify any data formats, types, or schemas, nor does it have features of more modern protocols such as version identifiers, data type identifiers, or authentication mechanisms.  In essence, the data and format of data varies substantially between service providers with no standard means of defining what one should expect from a NICNAME/WHOIS server. Whois-RWS was created as an alternative to the ARIN Whois and will provide much richer functionality and capability to the community.

Whois-RWS

ARIN’s Whois RESTful Web Service (Whois-RWS) is the directory service for accessing registration data contained within ARIN’s registration database. Whois-RWS can easily be integrated into command line scripts similar to Whois or RWhois, or it can be used with a web browser. This gives Whois-RWS the ability to be both applicable for programmatic consumption while also being accessible for human consumption.

For those who rely on existing scripts and clients, ARIN will continue to maintain services for the NICNAME/WHOIS protocol on TCP/43. This is achieved by using a proxy service to translate traditional ARIN Whois queries into Whois-RWS queries. However, ARIN recommends use of the RESTful Web Service for automation and programmatic consumption given the shortcomings of the NICNAME/WHOIS protocol.  Information on ARIN’s Whois data model, the API, and the RESTful interface may be found at the Whois documentation.

The Whois-RWS Proxy is an improvement over the existing Whois service in that it has the following new features:

  • Support for new query types such as CIDR queries
  • Provides better feedback for ambiguous queries
  • Contains more finely scoped record type queries
  • Provides options for NICNAME/WHOIS clients that re-interpret traditional parameters used by ARIN's service.
  • Includes RESTful URL references, useful for embedding into documents and email
  • Includes better grouping of record types and delineation of results

Another benefit to this change is that data from ARIN’s registration database is distributed to the Whois-RWS servers many times throughout the day, versus the once-a-day update of ARIN’s previous Whois service. Changes will be reflected more quickly through Whois-RWS, so query results will be more current than the previous Whois service.

Whois-RWS Proxy Features vs. Whois

The previous Whois service did not rigorously conform to the help instructions (to retrieve the help file, use the “? “query). Whois-RWS Proxy follows the help instructions much more closely. Aside from these differences, the list below describes the changes between Whois and Whois-RWS Proxy.

New Queries with the Whois-RWS Proxy

Entity and All Queries

When queries without record types were issued against the previous Whois service, in some cases a record type was assumed but in many cases many fields of all record types were searched. The result of such searches could easily lead to confusion.  This behavior has been changed to yield more predictable results.  Assumptions made by the service are explicitly given, and queries without record types that have no other semantic context are limited to searches of names of points of contacts, organizations and customers.  This type of query has a meta-record type of “e”.

The search of all record types is still available, but must explicitly be given with the “z” meta-record type.

CIDR Queries

A new record type of “r” indicates CIDR notation IP address space queries.  If the “r” record type is omitted but the query contains a CIDR notation IP network, the Whois-RWS Proxy will assume the “r” record type.

Query rewrite notification

A “/” attribute flag has been added to signify the name attribute.  This is identical to the existing “.” attribute flag, which is also still available. However, the “/” attribute works better with some NICNAME/WHOIS clients that use the period character in the interpretation of IDNS.  Without the “/” attribute flag, such clients are incapable of specifying this attribute.

Specific Differences in Whois-RWS Proxy

Query rewrite notification

What is Different : The engine now considers queries without flags "ambiguous". To assist the user in understanding what the engine’s best guess of the user’s intent is comment lines are inserted at the top. The substituted flag-based query is shown.

Why it matters: Whois currently yields broader (e.g. more related, more cluttered) results. New output is more refined, and query rewrite explains what the engine's doing.

Old Behavior:

> whois ZD63-ARIN

<Results>

New Behavior:

> whois ZD63-ARIN

#

# Query terms are ambiguous.  The query is assumed to be:

#     "p ! ZD63-ARIN"

#

# Use "?" to get help.

<results>

Header lines before output

What is Different : Results include a link to the http-based query mechanism that the user can use to get the query results via Whois-RWS (not TCP port 43); the engine provides a URL that the user can use later to requery the object.

Why it matters: Users that query TCP port-43-only will need to adjust parsing scripts. This feature will help users interested in moving query behavior to TCP port 80 RESTful queries.

Old Behavior:

> whois ZD63-ARIN

<results>

New Behavior:

> whois ZD63-ARIN

<results>

#

# The following results may also be obtained via:

# http://whois.arin.net/rest/pocs;handle=ZD63-ARIN?showDetails=true

#

<results>

Last updated date no longer displays

What is Different : Since Whois-RWS will be backed by a near-real-time database that is constantly updated, there is no more nightly refresh of the database; therefore, no "last updated date".

Why it matters: Some customers may use this date in their automated scripts to determine freshness of data.  It should be noted that such a use was incorrect.

Old Behavior:

> whois ZD63-ARIN

<results>

# ARIN Whois database, last updated 2010-05-15 20:00

# Enter ? for additional hints on searching ARIN's Whois database.

New Behavior:

> whois ZD63-ARIN

<results>

<other footer data>

Additional comment lines make the output longer

What is Different: To make all the comments and the Whois content easier to read, more comment lines and blank lines have been inserted into the overall output, making it longer.

Why it matters: Some users who parse TCP port 43 queries and expect fixed vertical spacing might have script breakage due to the new format. Improved readability makes the output more user-friendly.

Old Behavior

> whois AK386-ARIN

Name:       Kosters, Al

Handle:     AK386-ARIN

Company:

Address:    San Jose Christian School

Address:    1300 Sheffield Ave

City:       Campbell

StateProv:  CA

PostalCode: 95008

Country:    US

Comment:

RegDate:    2000-08-22

Updated:    2000-08-22

Phone:      +1-408-371-7741  (Office)

Email:      sjcschool@earthlink.net

# ARIN Whois database, last updated 2010-05-15 20:00

# Enter ? for additional hints on searching ARIN's Whois database.

#

# ARIN Whois data and services are subject to the Terms of Use

# available at https://www.arin.net/whois_tou.html

New Behavior:

> whois AK386-ARIN

#

# Query terms are ambiguous.  The query is assumed to be:

#     "p ! AK386-ARIN"

#

# Use "?" to get help.

#

#

# The following results may also be obtained via:

# http://whois.arin.net/rest/pocs;handle=AK386-ARIN?showDetails=true

#

 

Name:       Kosters, Al

Handle:     AK386-ARIN

Company:

Address:    San Jose Christian School

Address:    1300 Sheffield Ave

City:       Campbell

StateProv:  CA

PostalCode:  95008

Country:     US

RegDate:    2000-08-22

Updated:    2000-08-22

Phone:      +1-408-371-7741  (Office)

Email:      sjcschool@earthlink.net

Ref:         http://whois.arin.net/rest/poc/AK386-ARIN?showDetails=true

#

# ARIN Whois data and services are subject to the Terms of Use

# available at: https://www.arin.net/whois_tou.html

#

Empty "Comment:" tags no longer display

What is Different : The "Comment:" tag no longer displays if a record does not have comments in the database

Why it matters: Originally, the "Comment:" tag appeared in the output at all times so that a predictable tag sequence was available for users who parse the output.

Old Behavior:

> whois AK386-ARIN

Name:       Kosters, Al

Handle:     AK386-ARIN

Company:

Address:    San Jose Christian School

Address:    1300 Sheffield Ave

City:       Campbell

StateProv:  CA

PostalCode: 95008

Country:    US

Comment:

RegDate:    2000-08-22

Updated:    2000-08-22

Phone:      +1-408-371-7741  (Office)

Email:      sjcschool@earthlink.net

<footer>

New Behavior:

> whois AK386-ARIN

<header>

Name:       Kosters, Al

Handle:     AK386-ARIN

Company:

Address:    San Jose Christian School

Address:    1300 Sheffield Ave

City:       Campbell

StateProv:  CA

PostalCode: 95008

Country:    US

RegDate:    2000-08-22

Updated:    2000-08-22

Phone:      +1-408-371-7741  (Office)

Email:      sjcschool@earthlink.net

Ref:        http://whois.arin.net/rest/poc/AK386-ARIN?showDetails=true

<footer>

New "Ref:" Tag

What is Different : A new tag, "Ref:” has been added to provide the RESTful query location for the query, should the user want to use RESTful queries again

Why it matters: The addition of this tag may affect some automated parsers.  A query string is also provided in the header, though the content is different (header URL replicates the verall query, while Ref: URL provides a pointer to each individual record).

Old Behavior:

> whois AK386-ARIN

Name:       Kosters, Al

Handle:     AK386-ARIN

Company:

Address:    San Jose Christian School

Address:    1300 Sheffield Ave

City:       Campbell

StateProv:  CA

PostalCode: 95008

Country:    US

Comment:

RegDate:    2000-08-22

Updated:    2000-08-22

Phone:      +1-408-371-7741  (Office)

Email:      sjcschool@earthlink.net

<footer>

New Behavior:

> whois AK386-ARIN

<header>

Name:       Kosters, Al

Handle:     AK386-ARIN

Company:

Address:    San Jose Christian School

Address:    1300 Sheffield Ave

City:       Campbell

StateProv:  CA

PostalCode: 95008

Country:    US

RegDate:    2000-08-22

Updated:    2000-08-22

Phone:      +1-408-371-7741  (Office)

Email:      sjcschool@earthlink.net

Ref:        http://whois.arin.net/rest/poc/AK386-ARIN?showDetails=true

<footer>

Truncation comments now display above results only

What is Different : With the ARIN Whois, if a user enters a query that returns more than a set number of results, a "truncation" message is triggered both above and below the results. Whois-RWS only displays this truncation message above the results and has additional vertical spacing, i.e. extra blank lines.

Why it matters: Parsers relying on/expecting truncation messages after the text may need to be adjusted.

Old Behavior:

> whois Smith

<truncation message>

<results>

# This query resulted in more than 256 records. Remaining results

# have been truncated. For more specific results, go to

# http://ws.arin.net/whois for help in refining your query.

<footer>

New Behavior:

>whois Smith

<header>

# This query resulted in more than 256 records. Remaining results

# have been truncated. For more specific results, use

# a question mark (?) to find information on refining

# your query.

<results>

<footer>

Number resource queries return data in a different grouping sequence

What is Different : The ARIN Whois groups results in the following order: AS, NET, and SWIP queries (individual or full-output-forced by +) return ORG first, then the RESOURCE, then the related POCs. Whois-RWS query groupings follow the pattern: RESOURCE, then ORG, then POCs.

Why it matters: The new behavior is more intuitive (you get what you asked for first). The change will require users to adjust parsers that expect Org labels before the resource labels.

Old Behavior:

> whois AS12345

<org information>

<as information>

<org and resource pocs>

<footer>

New Behavior:

> whois AS12345

<header>

<as information>

<org information>

<org and resource pocs>

<footer>

Results returned by record type

What is Different : Generalized text queries now group by record type, and provide a RESTful link for requerying each group

Why it matters: ARIN does not believe this will impact customer interactions in any way with the exception of the additional comment lines signified by #.

Old Behavior:

> whois ARIN

...

American Registry for Internet Numbers (ARIN)

8e6 ARIN Admin  (8AA-ARIN)     arin@8e6.com +1-714-282-6111

<lots of records>

New Behavior:

> whois arin

<header>

#

# The following results may also be obtained via:

# http://whois.arin.net/rest/orgs;name=arin?showDetails=true

#

American Registry for Internet Numbers (ARIN)

#

# The following results may also be obtained via:

# http://whois.arin.net/rest/pocs;name=arin?showDetails=true

#

ARIN (ARIN1-ARIN) arin@us.loreal.com +1-732-499-2910

...

<lots of records>

Multiple results presented in full output (forced by "+") now delimited for clarity

What is Different : When using the ARIN Whois, any query resulting in multiple hits, that's also forced to full-output with "+", displays each in full output. The results are then very difficult to read.  Whois-RWS puts commented delimiters around each result, clarifying the start/end of each result.

Why it matters: Some parsers may need adjusting, but the clarity should significantly help parsers to understand the start and end of each result.

Old Behavior:

> whois "american"

...

<an Org result>

<an Org result>

<a POC result>

<a NET result>

<a NET result>

...

New Behavior:

> whois "american"

...

# begin result

<an Org result>

# end result

 

# begin result

<an Org result>

# end result

 

# begin result

<a POC result>

# end result

 

# begin result

<a NET result>

# end result

 

# begin result

<a NET result>

# end result

....

Fields in different sequence

What is Different : Whois-RWS Proxy outputs Comment below RegDate: and Updated:

Why it matters: Customers with sequence-dependent parsers will need adjustment. Note records without comments don't display the tag at all in Whois-RWS Proxy.

Old Behavior:

> whois MWA212-ARIN

...

PostalCode: 84663

Country:    US

Comment:    http://www.kydance.net/

RegDate:    2009-08-24

Updated:    2009-08-24

Phone:      +1-801-400-9708  (Office)

Email:      mwalker@kydance.net

...

New Behavior:

> whois MWA212-ARIN

...

PostalCode:     84663

Country:        US

RegDate:        2009-08-24

Updated:        2009-08-24

Comment:        http://www.kydance.net/

Phone:          +1-801-400-9708 (Office)

Email:          mwalker@kydance.net

...

POC Queries

Word-by-word queries no longer function

What is Different : The ARIN Whois permitted a query that would search word-by-word for POCs and return results. This behavior was never documented. Example: if POC name "Cox Abuse Contact" were registered, then "Cox", "Cox Abuse", or "Cox Abuse Contact" would return it. With Whois-RWS Proxy queries, the user must use the wildcard.

Why it matters: This old behavior is unintuitive, can frequently yield unexpected results, and is not frequently used in Whois queries. Users can use wildcard (*) to obtain similar results.

Old Behavior:

> whois "p earthlink"

Earthlink Inc. (TN-IS-ARIN) togetherDNS@mindspring.net +1-626-296-2400

Earthlink Network, Domain Administrator (ELN-DA-ARIN) hostmaster@earthlink.net +1-626-296-2400

...

New Behavior:

> whois "p earthlink*"

#

# The following results may also be obtained via:

# http://whois.arin.net/rest/pocs;q=earthlink*?showDetails=true

#

Earthlink Inc. (TN-IS-ARIN) togetherDNS@mindspring.net +1-626-296-2400

…more…

Query for local-part of email address no longer supported

What is Different : The ARIN Whois permitted query on the local-part (before the "@") of the email address to find POCs. This query is not supported by Whois-RWS.

Why it matters: This change should have minimal impact. ARIN analysis of the Whois logs revealed that this feature is very rarely used.

Old Behavior:

> whois sjcschool

Name:       Kosters, Al

Handle:     AK386-ARIN

...

Email:      sjcschool@earthlink.net

New Behavior:

> whois sjcschool

<No match found for sjcschool.>

ASN Queries

AS output tag sequence

What is Different : Whois-RWS Proxy output for a single AS registration presents the data in different tag sequence and format. Two new fields, the organization's Regdate: and Updated: have been added, and the Referral Server: tag has moved to the bottom of Org data.

Why it matters: Automated parsers using tag sequence algorithms will need adjusting to account for RegDate and Updated tags in both the ASN and Org records.

Old Behavior:

> whois AS701

OrgName:    MCI Communications Services, Inc. d/b/a Verizon Business

OrgID:      MCICS

Address:    22001 Loudoun County Pkwy

City:       Ashburn

StateProv:  VA

PostalCode: 20147

Country:    US

Referral Server: rwhois://rwhois.verizon.com:4321/

ASNumber:   701 - 705

ASName:     UUNET

ASHandle:   AS701

Comment:

RegDate:    1990-08-03

Updated:    2008-07-24

New Behavior:

> whois AS701

<header>

ASNumber:       701

ASName:         UUNET

ASHandle:       AS701

RegDate:        1990-08-03

Updated:        2008-07-24

Ref:            http://whois.arin.net/rest/asn/AS701

OrgName:        MCI Communications Services, Inc. d/b/a Verizon Business

OrgId:          MCICS

Address:        22001 Loudoun County Pkwy

City:           Ashburn

StateProv:      VA

PostalCode:     20147

Country:        US

RegDate:        2006-05-30

Updated:        2009-12-07

Ref:            http://whois.arin.net/rest/org/MCICS

Referral Server: rwhois://rwhois.verizon.com:4321/

Word-by-word queries do not return AS registrations held by org names containing the query words

What is Different : The ARIN Whois permitted a query that would search word-by-word for Org names that hold ASs. This query behavior was never documented. Example: if Org name "American Central Corp Inc." were registered then "American", "American Central", or "American Central Corp" would return ASs held. Whois-RWS Proxy does not do this.

Why it matters: The impact of this change is minimal because there are many other ways to get to this data. ARIN analysis of Whois logs showed this to be a very low volume query which always results in list output. To get similar information with Whois-RWS Proxy using wildcard (*) is a good substitute.

Old Behavior:

> whois "american central"

American Central (AS12345) ASN-NAME-1  12345

American Central Corp (ACC-132)

AMERICAN CENTRAL CREDIT (ACC-133)

American Central Gas Technologies, Inc (ACGT-1)

...

New Behavior:

> whois "american central"

<header>

OrgName:        American Central

OrgId:          AMERIC-271

Address:        1751 NW 86th Avenue

City:           Miami

StateProv:      FL

PostalCode:     33122

Country:        US

Org Queries

Word-by-word queries do not return orgs containing the query words in the org name

What is Different: The ARIN Whois permitted a query that would search word-by-word for Org names and return results. This query behavior was never documented. Example: if Org name "American Central Corp Inc." were registered, then "American", "American Central", or "American Central Corp" would return it. This result will not be returned using Whois-RWS Proxy.

Why it matters: Users will need to explicitly give the “*” character to signal partial match searches. This will give a more intuitive feel as expected result behavior will more closely match given queries.  ARIN resource holders may also use the reporting features of ARIN Online to obtain downstream organization and network information.

Old Behavior:

> whois "american central"

American Central (AMERIC-271)

American Central Corp (ACC-132)

AMERICAN CENTRAL CREDIT (ACC-133)

American Central Gas Technologies, Inc (ACGT-1)

...

New Behavior:

> whois "american central"

<header>

OrgName:        American Central

OrgId:          AMERIC-271

Address:        1751 NW 86th Avenue

City:           Miami

StateProv:      FL

PostalCode:     33122

Country:        US

NET Queries

Word-by-word queries do not return networks held by orgs containing the query words in the org name

What is Different : The ARIN Whois permitted a query that would search word-by-word for Org names that hold NETs. This query behavior was never documented. Example: if Org name "American Central Corp Inc." were swipped then "American", "American Central", or "American Central Corp" would return NETs held. This result will not be returned using Whois-RWS.

Why it matters: The impact of this change is minimal because there are many other ways to get to this data.  ARIN analysis of Whois logs showed this to be a very low volume query which always results in list output. To get similar information with Whois-RWS Proxy, using wildcard (*) is a good substitute. 

Old Behavior:

> whois "american central"

American Central (AMERIC-271)

American Central Corp (ACC-132)

AMERICAN CENTRAL CREDIT (ACC-133)

American Central Gas Technologies, Inc (ACGT-1)

...

New Behavior:

> whois "american central"

<header>

OrgName:        American Central

OrgId:          AMERIC-271

Address:        1751 NW 86th Avenue

City:           Miami

StateProv:      FL

PostalCode:     33122

Country:        US

Customer Network Queries

Word-by-word queries do not return customer networks (simple reassigns); they now return Customer Orgs

What is Different : The ARIN Whois permitted a query that would search word-by-word for Customer names. This query behavior was never documented. Example: if Customer name "American Central Corp Inc." were swipped then "American", "American Central", or "American Central Corp" would be in the results. This particular query will not return the same results using Whois-RWS Proxy.

Why it matters: Users will need to explicitly give the “*” character to signal partial match searches, and should explicitly employ the “c”, “e”, and “z” record type flags. This will give a more intuitive feel as expected result behavior will more closely match given queries.  ARIN resource holders may also use the reporting features of ARIN Online to obtain downstream organization and network information.

Old Behavior:

> whois "american central"

...

American Central PAET-MI-AMERI-1 (NET-64-80-64-160-1) 64.80.64.160 - 64.80.64.175

American Central Corp PAET-MI-ACC (NET-64-80-84-16-1) 64.80.84.16 - 64.80.84.31

...

New Behavior:

> whois "c american central*"

<header>

American Central Gas SBC066141206160020927 (NET-66-141-206-160-1) 66.141.206.160 - 66.141.206.167

American Central Gas Technologies …..

Whois-RWS Half-open Server Behavior

The Whois-RWS Proxy has many mechanisms designed to safeguard the service against abusive behavior. Unfortunately, these mechanisms make the use of half-open connections unusable. Following the example in sections 2 and 3 of RFC 3912,the Whois-RWS server closes the connection after sending a query response. As a result, Whois-RWS will not support half-closed connections where the client sends a FIN before receiving the data. This differs from ARIN's legacy Whois service which is not conformant to this particular WHOIS protocol specification. Any WHOIS clients or tools making use of half-open connections should be modified to leave the connection fully open as specified in RFC 3912.