1

Running whois 74.93.16.177 on my laptop gives me information back and tells me the IP belongs to Comcast.

However calling the Whois REST API tells me that the IP is not managed by RIPE. I'm also able to get the same results as my local whois query by searching on online public RIPE mirrors.

See: https://rest.db.ripe.net/search.json?query-string=74.93.16.177

Which gives

  "attribute" : [ {
    "name" : "inetnum",
    "value" : "74.0.0.0 - 74.255.255.255"
  }, {
    "name" : "netname",
    "value" : "NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK"
  }, {
    "name" : "descr",
    "value" : "IPv4 address block not managed by the RIPE NCC"
  }, {
    "name" : "remarks",
    "value" : "------------------------------------------------------"
  }, {

Whereas on the command line, whois 74.93.16.177 gives

NetRange:       74.93.16.0 - 74.93.19.255
CIDR:           74.93.16.0/22
NetName:        CBC-CONNECTICUT-7
NetHandle:      NET-74-93-16-0-1
Parent:         CBC-CM-4 (NET-74-92-0-0-1)
NetType:        Reallocated
OriginAS:       
Organization:   Comcast Cable Communications, LLC (CCCS)
RegDate:        2007-11-13
Updated:        2017-11-01
Ref:            https://whois.arin.net/rest/net/NET-74-93-16-0-1



OrgName:        Comcast Cable Communications, LLC
OrgId:          CCCS
Address:        1800 Bishops Gate Blvd
City:           Mt Laurel
StateProv:      NJ
PostalCode:     08054
Country:        US
RegDate:        2001-09-17
Updated:        2017-01-28
Ref:            https://whois.arin.net/rest/org/CCCS

How do I make the correct call to the REST API to get the same response as I would on the command line except in JSON?

1 Answer 1

2

You are not looking at the same "object" in both cases. At RIRs, an IP object is not just an IP address, it is in fact an IP block of addresses, as RIRs distributes blocks of adresses to LIRs.

As you can see:

  • in first case the result is about 74.0.0.0 - 74.255.255.255 aka 74.0.0.0/8
  • in second case, it is about 74.93.16.0 - 74.93.19.255 aka 74.93.16.0/22

The second block is contained in the first one, but each block has different owner and metadata.

You can see in https://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xhtml that 74.0.0.0/8 has been allocated to ARIN in 2005. So you need to query ARIN services to have information on this block (and its inside blocks), this is why in the first reply RIPE is telling you "IPv4 address block not managed by the RIPE NCC".

You have ARIN documentation here: https://www.arin.net/resources/whoisrws/whois_api.html

So in your case you will need to use http://whois.arin.net/rest/ip/74.93.16.177.json which yields:

{
"net": {
"@xmlns": {
  "ns3": "http://www.arin.net/whoisrws/netref/v2",
  "ns2": "http://www.arin.net/whoisrws/rdns/v1",
  "$": "http://www.arin.net/whoisrws/core/v1"
},
"@inaccuracyReportUrl": "https://www.arin.net/public/whoisinaccuracy/index.xhtml",
"@termsOfUse": "https://www.arin.net/whois_tou.html",
"registrationDate": {
  "$": "2007-11-19T17:26:42-05:00"
},
"ref": {
  "$": "https://whois.arin.net/rest/net/NET-74-93-16-176-1"
},
"customerRef": {
  "@handle": "C01782735",
  "@name": "HOYLE TANNER AND ASSOC",
  "$": "https://whois.arin.net/rest/customer/C01782735"
},
"endAddress": {
  "$": "74.93.16.183"
},
"handle": {
  "$": "NET-74-93-16-176-1"
},
"name": {
  "$": "HOYLETANNERANDASSOC"
},
etc.

Note that the result is for 74.93.16.176/29 which is even more specific than 74.93.16.176/22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.