30.3 Whois Protocol

30.3 Whois Protocol

The Whois protocol is another information service. Although any site can provide a Whois server, the one at the InterNIC, rs.internic.net, is most commonly used. This server maintains information about all registered DNS domains and many system administrators responsible for systems connected to the Internet. (Another server is provided at nic.ddn.mil, but contains information only about the MILNET.) Unfortunately the information can be out of date or incomplete. RFC 954 [Harrenstien, Stahl, and Feinler 1985] documents the Whois service.

From a protocol perspective, the Whois server has a well-known TCP port of 43. It accepts connection requests from clients , and the client sends a one-line query to the server. The server responds with whatever information is available and then closes the connection. The requests and replies are transmitted using NVT ASCII. This is almost identical to the Finger server, although the requests and replies contain different information.

The common Unix client is the whois (1) program, although we can use Telnet and type in the commands ourself. The starting place is to send a request consisting of just a question mark, which returns more detailed information on the supported client requests.

When the NIC moved to the InterNIC in 1993, the site for the Whois server moved from nic.ddn.mil to rs.internic.net . Many vendors still ship versions of the whois client with the name nic.ddn.mil built in. You may need to specify the command-line argument -h rs.internic.net to contact the correct server.

Alternately, we can Telnet to rs.internic.net and login as whois.

We'll use the Whois server to track down the author. (We've removed the extraneous Telnet client output.) Our first request is for all names that match "stevens."

 sun %  telnet rs.internic.net whois   stevens   this is the client command we type   information on 25 other "stevens" that we omit  Stevens, W. Richard (WRS28)    [e-mail]       [phone]     The InterNIC Registration Services Host ONLY contains Internet     Information (Networks, ASN's, Domains, and POC's).     Please use the whois server at nic.ddn.mil for MILNET Information. 

The three uppercase letters followed by a number in parentheses after the name, ( WRS28 ), are the person's NIC handle. The next query contains an exclamation point and a NIC handle, to fetch more information about this person.

 sun %  telnet rs.internic.net whois   !wrs28   client request that we type  Stevens, W. Richard (WRS28)                [e-mail]        Kohala Software        1202 E. Paseo del Zorro        Tucson, AZ 85718        [phone]        Record last updated on 11-Jan-91. 

Lots of additional information about Internet variables can also be queried. For example, the request net 140.252 returns information about the class B address 140.252.

White Pages

Using the VRFY command of SMTP, along with the Finger protocol and the Whois protocol to locate users on the Internet is similar to using the white pages of a telephone book to find someone's phone number. At the present time ad hoc tools such as these are all that's widely available, but research is under way to improve this type of service.

[Schwartz and Tsirigotis 1991] contains additional information on various white pages services being tried on the Internet. The particular tool, called Netfind, can be accessed by using Telnet to either bruno.cs. colorado .edu or ds.internic.net and logging in as net find.

RFC 1309 [Weider, Reynolds, and Heker 1992] provides an overview of the OSI directory service, called X.500, and compares and contrasts it with current Internet techniques (Finger and Whois).