nanog mailing list archives

Re: whois syntax


From: Andrew Brown <twofsonet () graffiti com>
Date: Fri, 19 Oct 2001 09:56:25 -0400


i was arguing with my friend about whois servers.  he thought that all
whois servers were relatively similar in design and function, and i
convinced that wasn't the case.

In theory they are all similar. In theory, all languages in the world are 
similar in design and function. They enable people to communicate and 
express ideas. Whois servers allow people to find out information about 
domains, hosts, and netblocks. Every company seems to have a different way 
of doing this.

in theory the protocols that flow over "well known ports" are somewhat
standardized.  it seems, instead, that the protocols are sometimes
standardized and sometimes not, with a broad array of alternatives in
between.

the output of all of them differs (which makes parsing the output a
lot of fun :).

There is no standard specified in the RFC for output, just for query language.

the thing that gets me, though, is that the radb.net whois server
seems to have some 'extended command language' whereby one can pass
query after query over one tcp connection and not get dropped.  is
this 'language' documented anywhere, or do i just have to find and
read source code that uses it?

As is usually the case, the RFCs are far too wordy. Basically, there are a 
number of basic mandatory functions and a larger set of optional commands 
which can be implemented if the developer desires. Since I have written 
several whois and rwhois servers, I have distilled the essential functions 
down to a one page cheat sheet I use to query and to write/modify our whois 
servers.

The command you are looking for is part of the standard features:

-holdconnect on (for multiple commands, keep the connection open after 
sending the response)

-holdconnect off (to disconnect after the response is sent)

actually...it turns out that it's rpsl, and the commands you have here
aren't understood by this whois server.  you might be using those, but
they aren't.

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior () daemon org             * "ah!  i see you have the internet
twofsonet () graffiti com (Andrew Brown)                that goes *ping*!"
andrew () crossbar com       * "information is power -- share the wealth."


Current thread: