Planet Admon

Common Howtos on Linux System Administration

Query IP whois info in python

January 18th, 2010 by joseph Leave a reply »

This is a simple python script based on some former rwhois code. It shows us an easy way on how to get detailed information about a specific IP address:

joseph@e54:~$ python ip-whois.py 94.75.214.11
====== whois.arin.net                        

OrgName:    RIPE Network Coordination Centre
OrgID:      RIPE
Address:    P.O. Box 10096
City:       Amsterdam
StateProv:
PostalCode: 1001EB
Country:    NL

ReferralServer: whois://whois.ripe.net:43

NetRange:   94.0.0.0 - 94.255.255.255
CIDR:       94.0.0.0/8
NetName:    94-RIPE
NetHandle:  NET-94-0-0-0-1
Parent:
NetType:    Allocated to RIPE NCC
NameServer: NS-PRI.RIPE.NET
NameServer: SEC1.APNIC.NET
NameServer: SEC3.APNIC.NET
NameServer: TINNIE.ARIN.NET
NameServer: NS2.LACNIC.NET
Comment:    These addresses have been further assigned to users in
Comment:    the RIPE NCC region. Contact information can be found in
Comment:    the RIPE database at http://www.ripe.net/whois
RegDate:    2007-07-30
Updated:    2009-05-18

The source code is listed below. You may copy the code into a text file and name it as ip-query.py:

#!/usr/bin/env python
# Forwarded version from thomasfischer.biz!!!
#
import os, sys, string, time, getopt, socket, select, re, errno, copy, signal        

def queryWhois(query, server='whois.ripe.net'):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    while 1:
        try:
            s.connect((server, 43))
        except socket.error, (ecode, reason):
            if ecode==errno.EINPROGRESS:
                continue
            elif ecode==errno.EALREADY:
                continue
            else:
                raise socket.error, (ecode, reason)
            pass
        break                                            

    ret = select.select ([s], [s], [], 30)

    if len(ret[1])== 0 and len(ret[0]) == 0:
        s.close()
        raise TimedOut, "on data"           

    s.setblocking(1)

    s.send("%sn" % query)
    page = ""
    while 1:
        data = s.recv(8196)
        if not data: break
        page = page + data
        pass

    s.close()

    if string.find(page, "IANA-BLK") != -1:
        raise 'no match'

    if string.find(page, "Not allocated by APNIC") != -1:
        raise 'no match'

    return page

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print "usage: %s " % sys.argv[0]
        sys.exit(1)
    ip = sys.argv[1]

    for server in ['whois.arin.net', 'whois.ripe.net', 'whois.apnic.net', 'whois.lacnic.net', 'whois.afrinic.net']:
        try:
            res = queryWhois(ip, server)
            print '======', server
            print res
            break # we only need the info once
        except:
            pass

If you wanna find whois information about some domain names, you might need to re-write these open-sourced scripts. An suggested alternative choice is pywhois which is hosted by code.google.com.

Share this