The Team Cymru WHOIS Server

Introduction

Team Cymru is happy to announce the availability of a public whois server dedicated to mapping IP numbers to ASNs, located at whois.cymru.com. We have also extended the functionality of this daemon to support BULK IP submissions when combined with netcat, for those who wish to further optimize their queries.

We recommend the use GNU's version of netcat, not nc. (nc has been known to cause buffering problems with our server and will not always return the full output for larger IP lists). GNU netcat can be downloaded from http://netcat.sourceforge.net. This is the same as gnetcat in FreeBSD ports.

The data provided by the whois server is based on 17 BGP peers, and is updated every 30 minutes.

Using the WHOIS Server

Following is a quick overview of how to use the Team Cymru whois server:

	$ whois -h whois.cymru.com <IP>

Where <IP> is replaced by the IP you'd like to map, like so:

	$ whois -h whois.cymru.com 68.22.187.8
	ASN     | IP               | Name                          
	23028   | 68.22.187.8      | SAUNET SAUNET

You can also include comments in your queries. These might be port information, timestamps, or anything else you wish to include in the formatted output. The whois server does not care about such comments and does not interpret them (e.g. make timezone conversions). Be sure to include quotes around your queries, or the daemon will interpret your request as multiple lines:

	$ whois -h whois.cymru.com "68.22.187.8 -0600 GMT"
	ASN     | IP               | Info            | Name                          
	23028   | 68.22.187.8      | -0600 GMT       | SAUNET SAUNET

Bulk queries are also accepted. To issue bulk queries, follow these steps.

1. Create a list of IPs, one per line. Add the word begin at the top of the file and the word end at the bottom.

Example of list01:

	begin
	68.22.187.5
	207.229.165.18
	...
	198.6.1.65
	end

You can add comments if you like.

	begin
	68.22.187.5 Checked on 2004-06-30 05:05:05 GMT
	207.229.165.18 Checked on 2004-06-30 05:05:05 GMT
	...
	198.6.1.65 Checked on 2004-06-30 05:05:05 GMT
	end

2. Run the list through GNU netcat (NOT the venerable nc).

Command example:

	$ netcat whois.cymru.com 43 < list01 | sort -n > list02

The file list02 will be sorted by origin AS, and should appear as:

	Bulk mode; one IP per line. [2004-06-30 15:37:07 GMT]
	701     | 198.6.1.65       | UU UUNET Technologies, Inc.
	6079    | 207.229.165.18   | RCN RCN Corporation
	23028   | 68.22.187.5      | SAUNET SAUNET

3. Take a peek at the list02 file, and remove any RFC1918 or other unrouted IPs.

Additional help can be obtained by issuing the help command.

	$ whois -h whois.cymru.com help

We hope you find this tool useful. Stay tuned for more features!

If you have any comments or suggestions as to how we might improve this service, feel free to let us know!

[ BGP Page ] [ HOME ]

team-cymru at cymru.com