WHOB(8)

💖 WHOB(8) — the whois-adjacent glow-up, from the System Manager's Manual 💖

okay bestie, sit down, hydrate, and let me tell you about whob — she lives in section 8 of the system manager's manual and she is literally the moment.

---

✨ NAME ✨

whob — display whois-type information of interest to Internet operators 🫶

(no cap, that's the whole vibe: whois-flavored facts, but built for the people actually running networks)

---

🦋 SYNOPSIS 🦋

whob [-AaCcgNnOopPRrstuVv] [-h server] [-w server] [-f file] query | me
     | whoami

yes she's got a lot of flags. she's high maintenance and she's worth it. 💅

---

🌸 DESCRIPTION 🌸

So whob goes out and queries, like, various sources of whois info to pull data that's actually interesting to network operators and to their tracing-and-debugging tools. She's not here for gossip, she's here for routing data. 👑

And the way she outputs it? Designed to be easily parsed. Or — even better — you can just yeet her functionality straight into your own programs (peep whois.h). iykyk.

The only mandatory parameter is the target host name or IP address. Everything else is optional seasoning: options toggle extra data on and off, or switch which sources she's pulling from.

Now here's the iconic part — the one key advantage of whob: she looks up ASN information derived from the global Internet routing table itself, instead of only trusting what's been registered in the RADB/IRR (see below, babe, I got you). And that data comes by default from the global pWhoIs service. See www.pwhois.org. ✨

🎀 Options 🎀

• -A ASN — show ALL routing advertisements transiting that ASN. You can pass the ASN as the target argument, or you can hand her a hostname or IP address and whob will resolve the ASN for you automatically. she does the homework fr fr.
• -a ASN — show all routing advertisements made by that Origin-AS. Same deal: pass the Origin-AS as the target argument, or give a hostname or IP address and whob resolves the ASN herself.
• -P prefix — show all routing advertisements related to the CIDR prefix you supply. 🌈
• -N ASN — show all networks registered to the ASN you supply.
• -O ASN — show all contact information on file for the ASN you supply. 📇
• -g — disable GIGO mode. By popular request, whob takes input straight from the command line and passes it without modification to pWhoIs (or whatever whois server you asked for with -h). The exact output comes back, no parsing, zero edits. So if you want parsing and all those other useful options to actually do anything, turn GIGO mode off with -g. 💀
• -R — display the Origin-AS on record at the RADB/IRR (Routing Arbiter Database/Internet Routing Registry), in addition to the Origin-AS provided by the prefix-based whois data source.
• -n — display the network name on record with the IP network allocation registry (ARIN, RIPE, APNIC, etc.).
• -o — suppress the organization name on file at the registrar. By default the org name is shown; this flag hides it. 🙈
• -p — display the AS-Path from the perspective of the current pWhoIs server. Heads up bestie: the pWhoIs server may automatically exclude the initial, least-specific ASN it received from the operator of the network it's connected to (unless that ASN is the only/origin ASN, or has multiple peers). So this AS-Path is subjective — I said what I said. If you rely on it and want AS-Paths that correspond to your own network infrastructure, consider running your own pWhoIs server. See the -w option and www.pwhois.org.
• -t — display the date the route was last cached by the pWhoIs server. 🕰️
• -u — display dates in UTC/GMT instead of local time. Implies -t (so the cache-date display gets enabled as a side effect, sneaky but cute).
• -h server
• -w server — override the source of prefix-based whois data. Both flags are equivalent: each one sets the pWhoIs-compatible server to query instead of the default pWhoIs host. Accepts a hostname or IP address. two names, one destiny. 🫶
• -f file — read from file and submit its contents as bulk input to pWhoIs. Pass ‘-’ as file to read from stdin. The input is buffered and subject to the constraints of the current pWhoIs server. Output goes to stdout (which you can redirect) and will not be parsed. You may put additional instructions to pWhoIs at the beginning of the file, but those only apply to the first buffer of input. The first (left-most) field on each line must be the IP address; lines may be up to 255 characters long. 📏
• -c — use Cymru's whois server instead of pWhoIs for interactive queries. When used with -f, it uses Cymru for bulk file resolution. See www.cymru.com for details.
• -C — use Cymru's whois server for bulk file resolution (implies -f). This is the explicit bulk-Cymru mode; interactive queries are unaffected. 🔥
• -r — use RIPE NCC RIS instead of pWhoIs. When used with -f, it uses RIPE NCC riswhois for bulk file resolution. See www.ripe.net/projects/ris/.
• -s — display the version and status of the pWhoIs server and exit. 🚪
• -V — display verbose/debug output. Repeat it for extra verbosity (-VV, -VVV) — she can go deeper. 👀
• -v — display version information and exit.
• me | whoami — display this host's public IP address and exit. main character energy, honestly. 🌟

---

🔥 EXAMPLES 🔥

Basic query returning ASN, prefix, net name, and org name:

whob 1.2.3.4

Query with AS-Path and net name displayed, GIGO mode disabled:

whob -gnp 1.2.3.4

Bulk file resolution using Cymru:

whob -Cf iplist.txt

Display this host's public IP:

whob me

---

💜 SEE ALSO 💜

whois(1), lft(8) — go read those too, bestie, they're in the friend group.

---

⭐ HISTORY ⭐

The whob command first appeared in 2004. This whois framework has been a component of LFT since 2002. she's been serving looks for decades. 👑

---

🎀 AUTHORS 🎀

Victor Oppleman and Eugene Antsilevitch. 💖 legends, truly.

---

💀 BUGS 💀

To report bugs, send e-mail to ⟨whob@oppleman.com⟩. tell her what's wrong, she can take it.

---

and that's the whole page, bestie — brought to you by the WHOB source, System Manager's Manual, dated April 7, 2026. tysm for reading, go query something. 💅✨🦋