[PLUG-TALK] "whois" Result Formats

[drew wymore]

On Sun, Jul 19, 2009 at 7:21 AM, Rich Shepard <rshepard at appl-ecosys.com>wrote:

>   I'm confident that someone here can educate me on the reasons why the
> 'whois' command yields three different formats.
>
>   The most common format consists of multiple blocks presenting the name
> and
> location of the IP address holder, the range of IP addresses it controls,
> admin, technical, and abuse addresses. The second format is relatively
> recent and contains the above plus a large block that seems to repeat the
> above, and I assume this is the IPV6-related information.
>
>   An example of the first type is:
>
> inetnum:      195.56.186.128 - 195.56.186.255
> netname:      AKMI-HU-1
> descr:        Ministry of Transport Communication and Water Management
> descr:        Technical and Information Services on National Roads
> descr:        Budapest
> country:      HU
> admin-c:      RM2556-RIPE
> tech-c:       RM2556-RIPE
> tech-c:       ZR1-RIPE
> rev-srv:      ns.datanet.hu
> rev-srv:      ns.datanet.elte.hu
> status:       ASSIGNED PA
> mnt-by:       AS3340-MNT
> remarks:      abuse at kozut.hu
> source:       RIPE # Filtered
>
> plus more specific information.
>
>   The third format is not helpful for reporting spam to the hosting site:
> it
> consists only of the domain name and IP block address and, perhsps, the
> host
> of that domain with its IP address block. An example of this format is:
>
> Hoku Unlimited HOKU-UNLIMITED (NET-66-79-103-48-1)
>                                   66.79.103.48 - 66.79.103.63
> Nth Air, Inc. NTHAIRNET (NET-66-79-96-0-1)
>                                   66.79.96.0 - 66.79.127.255
>
> # ARIN WHOIS database, last updated 2009-07-18 20:00
> # Enter ? for additional hints on searching ARIN's WHOIS database.
>
>   Why this last format? It provides no contact information.
>
> Curious minds want to know,
>
> Rich
>

 Rich,
This part

Hoku Unlimited HOKU-UNLIMITED (NET-66-79-103-48-1)
                                  66.79.103.48 - 66.79.103.63
Nth Air, Inc. NTHAIRNET (NET-66-79-96-0-1)
                                  66.79.96.0 - 66.79.127.255


The first listed is the owner of the IP space from the IP registrar - ARIN
for North America. The second listed is a sub delegate of the first, usually
the first is an a larger level ISP sub-delegating IP space to a secondary
ISP or business that requires large IP blocks.

So Nth Air is getting blocks from Hoku in this example.

Does that help at all?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.pdxlinux.org/pipermail/plug-talk/attachments/20090719/64692767/attachment.html>