At the ISC we often get requests that end up in us using whois information in one way or another. This diary is about showing some 'tricks' we use to get to the details we need for such events.

PLEASE NOTE:

• These IP addresses are chosen for the educational value, no other implied things good or bad are to be assumed of them.
• Email addresses have been molested to reduce the impact of the bots searching for spam victims.
  

ARIN

ARIN deals with North American IP addresses.

$ whois -h whois.arin.net 129.128.5.191


So this IP address (taken from www.openbsd.org) tells me it's hosted at the University of Alberta in Canada, I do get a technical contact as well.


$ whois -h whois.arin.net 65.173.218.103

Sprint SPRINTLINK-2-BLKS (NET-65-160-0-0-1)
                                  65.160.0.0 - 65.174.255.255
ESCAL INSTITUTE OF ADVANCED FON-1101912576101565 (NET-65-173-218-0-1)
                                  65.173.218.0 - 65.173.218.255

# ARIN WHOIS database, last updated 2006-04-11 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

Where did all the detail go ?
Well this address is part of two blocks ARIN is keeping information on and you need to choose which of them you want to see details of. The part between the braces is the block you can select:

$ whois -h whois.arin.net  NET-65-160-0-0-1

OrgName:    Sprint
OrgID:      SPRN
Address:    12502 Sunrise Valley Drive
City:       Reston
StateProv:  VA
PostalCode: 20196
Country:    US

NetRange:   65.160.0.0 - 65.174.255.255
CIDR:       65.160.0.0/13, 65.168.0.0/14, 65.172.0.0/15, 65.174.0.0/16
NetName:    SPRINTLINK-2-BLKS
NetHandle:  NET-65-160-0-0-1
Parent:     NET-65-0-0-0-0
NetType:    Direct Allocation
NameServer: NS1-AUTH.SPRINTLINK.NET
NameServer: NS2-AUTH.SPRINTLINK.NET
NameServer: NS3-AUTH.SPRINTLINK.NET
Comment:    ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
RegDate:    2000-09-19
Updated:    2004-02-06

RTechHandle: SPRINT-NOC-ARIN
RTechName:   Sprintlink (Sprint)
RTechPhone:  +1-800-232-6895
RTechEmail:  NOC/at/sprint.net

OrgTechHandle: ARINS-ARIN
OrgTechName:   arin-sprint-iprequest
OrgTechPhone:  +1-800-232-3458
OrgTechEmail:  ip-req/at/sprint.net

# ARIN WHOIS database, last updated 2006-04-11 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

Well, this kind of information is of the bigger block that generally points to an ISP. It often contains abuse addresses the ISP prefers, but sprintlink didn't include that information here. They did however include an email address for the NOC.

Let's look at the smaller block:

$ whois -h whois.arin.net NET-65-173-218-0-1


It belongs to some institute which some of you might recognize ;-)

CYMRU

Is that all whois has to offer ?

No, by far not. Cymru keeps some more data relating to the routing fabric used on the Internet. As far as routing goes, the IP addresses on the Internet are devided in Autonomous Systems (AS). Each of those has a number, called a ASN. Those AS-es map back to ISPs. The ASNs are used by the ISPs in building links exchanging traffic (called peerings or upstreams). [This is a simplification, I know, but good enough for the purposes of this article].
You can find the AS an IP belongs to:

$ whois -h whois.cymru.com 129.128.5.191

AS      | IP               | AS Name
3359    | 129.128.5.191    | U-ALBERTA - University of Albe

$ whois -h whois.cymru.com  65.173.218.103

AS      | IP               | AS Name
1239    | 65.173.218.103   | SPRINTLINK - Sprint

Now the neat trick is that cymru has a whois server that is aware of the links between the ISPs as well:

$ whois -h v4-peer.whois.cymru.com 129.128.5.191

PEER_AS | IP               | AS Name
6509    | 129.128.5.191    | CANARIE-NTN - Canarie Inc

$ whois -h v4-peer.whois.cymru.com 65.173.218.103

PEER_AS | IP               | AS Name
209     | 65.173.218.103   | ASN-QWEST - Qwest
286     | 65.173.218.103   | KPN KPN Internet Backbone AS
701     | 65.173.218.103   | ALTERNET-AS - UUNET Technologi
1299    | 65.173.218.103   | TELIANET TeliaNet Global Netwo
1668    | 65.173.218.103   | AOL-ATDN - AOL Transit Data Ne
2516    | 65.173.218.103   | JPNIC-ASBLOCK-AP JPNIC
2914    | 65.173.218.103   | NTTA-2914 - NTT America, Inc.
3130    | 65.173.218.103   | RGNET-3130 RGnet/PSGnet
3257    | 65.173.218.103   | TISCALI-BACKBONE Tiscali Intl
3292    | 65.173.218.103   | TDC TDC Data Networks
3356    | 65.173.218.103   | LEVEL3 Level 3 Communications
3549    | 65.173.218.103   | GBLX Global Crossing Ltd.
3561    | 65.173.218.103   | SAVVIS - Savvis
4134    | 65.173.218.103   | CHINANET-BACKBONE No.31,Jin-ro
5511    | 65.173.218.103   | OPENTRANSIT France Telecom
6762    | 65.173.218.103   | SEABONE-NET Telecom Italia Spa
7018    | 65.173.218.103   | ATT-INTERNET4 - AT_T WorldNet
15412   | 65.173.218.103   | FLAG-AS Flag Telecom Global In

This gives you a list of ISPs that have a relationship with the ISP that is hosting the IP you are looking for. Should you be trying to push an unwilling ISP to act, contacting these peers in "cc" is a great means of applying presure.

RIPE

Now what happens if you try to lookup an address in Europe ?

$ whois -h whois.arin.net 194.7.3.21


That's not going to help you, RIPE is an organization much like ARIN, but instead of North America, they cover Europe and the Middle East.

Actually read more closely: ARIN does point you to whois.ripe.net, so let's contact that server.

$ whois -h whois.ripe.net 194.7.3.21

Cool, we got the ISP and an abuse contact.

The ASNs are filled out in this format as well. However, should you want to use the information, I'd trust the cymru results just that bit more.

APNIC

Moving on to Asia - Pacific, things change again. Should we try to pull the information off of ARIN, it will point us to whois.apnic.net (not show for brevity).

$ whois -h whois.apnic.net 202.30.50.50

OK, for tracking down an ISP this answer is a hard one. But read it carefully: it tells you to look for more detailed information on whois.nic.or.kr ...

$ whois -h whois.nic.or.kr 202.30.50.50

Cool, we got a NOC contact!

LACNIC

Lacnic is responsible for Latin America, let's try it:

$ whois -h whois.lacnic.net 200.160.7.7


Don't worry too much about those long lists of nameservers. They are almost always there with lacnic.

AfriNIC

I've never had to deal with the fifth RIR: AfriNIC in real life, but here is an example:

$ whois -h whois.afrinic.net 196.216.2.1

Domain names

Whois also can be used as an interface to see who owns what domain name, but that's for another time.

Other sources

There are many more sources of whois information. The trick aside from the starting points above is to read the comments that are given back. Sometimes some information isn't available through the whois information due to risks of abuse. Often they'll point you over to some website with some detection of automated processes and perhaps even only giving out the information as a gif file instead of text.

Update

A number of readers pointed out that they use the whois proxy at whois.geektools.com to prevent having to figure out which of the servers to use. You use it as:

$ whois -h whois.geektools.com 10.0.0.0

They sometimes also assumed that I used it myself. I actually use the whois client from OpenBSD. It connects on it's own to the appropriate RIR, based on the output of ARIN.

--
Swa Frantzen - Section 66