How can I limit the output of the whois command?

Question

How do I get only the owner/orgname from a PTR whois lookup? I don't need all the other entires, just the part about ownership (google in this case).

Edit /usr/bin/whois 74.125.236.52 or any ip get OrgName

  #
  # Query terms are ambiguous.  The query is assumed to be:
  #     "n 74.125.236.52"
  #
  # Use "?" to get help.
  #

  #
  # The following results may also be obtained via:
  # http://whois.arin.net/rest/nets;q=74.125.236.52?showDetails=true&showARIN=false&ext=netref2
  #

  NetRange:       74.125.0.0 - 74.125.255.255
  CIDR:           74.125.0.0/16
  OriginAS:
  NetName:        GOOGLE
  NetHandle:      NET-74-125-0-0-1
  Parent:         NET-74-0-0-0-0
  NetType:        Direct Allocation
  RegDate:        2007-03-13
  Updated:        2012-02-24
  Ref:            http://whois.arin.net/rest/net/NET-74-125-0-0-1


  OrgName:        Google Inc.
  OrgId:          GOGL
  Address:        1600 Amphitheatre Parkway
  City:           Mountain View
  StateProv:      CA
  PostalCode:     94043
  Country:        US
  RegDate:        2000-03-30
  Updated:        2011-09-24
  Ref:            http://whois.arin.net/rest/org/GOGL

  OrgAbuseHandle: ZG39-ARIN
  OrgAbuseName:   Google Inc
  OrgAbusePhone:  +1-650-253-0000
  OrgAbuseEmail:  arin-contact@google.com
  OrgAbuseRef:    http://whois.arin.net/rest/poc/ZG39-ARIN

  OrgTechHandle: ZG39-ARIN
  OrgTechName:   Google Inc
  OrgTechPhone:  +1-650-253-0000
  OrgTechEmail:  arin-contact@google.com
  OrgTechRef:    http://whois.arin.net/rest/poc/ZG39-ARIN

  #
  # ARIN WHOIS data and services are subject to the Terms of Use
  # available at: https://www.arin.net/whois_tou.html
  #

Well, that edit changed the thrust of the question somewhat. @Rajeev, is it the *domain name* or the *organisation name* that you're really after? — nickgrim, Sep 14 '12 at 12:09

nickgrim · Answer 1 · 2012-09-14T12:22:44.597

6

If you want the domain name of the owner of an IP-address (rather than, say, a company name), perhaps you might be better served by using dig -x ?

$ dig +short -x 74.125.236.52
maa03s04-in-f20.1e100.net.

-- EDIT --

If you just want the "OrgName:" line from the whois output, you can single it out with grep:

$ whois 74.125.236.52 | grep OrgName
OrgName:        Google Inc.

As mentioned elsewhere though, this may not always work, since the output-format is not specified anywhere.

edited Sep 14 '12 at 12:22

answered Sep 14 '12 at 11:51

nickgrim

4,336
1
17
27

how to get google domain name using above – Rajeev Sep 14 '12 at 11:54
The domain `1e100.net` is owned by Google - not all of Google's services live on a "google.com" domain. Specifically, it's the domain that all Google servers live on, as per http://support.google.com/bin/answer.py?hl=en&answer=174717 – nickgrim Sep 14 '12 at 12:06
but what if i want to query other servers info – Rajeev Sep 14 '12 at 12:10
Feel free to edit the question to list *exactly* what you're after. – nickgrim Sep 14 '12 at 12:12
i have edited the question – Rajeev Sep 14 '12 at 12:19

score 3 · Answer 2 · edited Oct 08 '16 at 15:42

3

The whois output is not standardized, so there isn't any toggle to only get the information you're looking for.

What you need is some parsing (grep/sed/ awk and so on), and this site is not suited for that. Ask on Stack Overflow instead.

edited Oct 08 '16 at 15:42

user123456

513
1
6
18

answered Sep 14 '12 at 11:48

pauska

19,532
4
55
75

score 2 · Answer 3 · answered Sep 16 '20 at 10:04

man whois return how to can format data for get only that you like

Example

whois -H -K 37.247.93.241

% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.
% Only primary keys and abuse contacts will be visible.
% No other contact information will be shown.

% Abuse contact for '37.247.93.0 - 37.247.93.255' is 'abuse@envia-tel.net'

inetnum:        37.247.93.0 - 37.247.93.255

route:          37.247.64.0/19
origin:         AS21413

% This query was served by the RIPE Database Query Service version 1.97.2 (HEREFORD)

How can I limit the output of the whois command?

3 Answers3