Friday, 22 May 2026

whois under the hood (just basic TCP)

The whois protocol is a very basic TCP-based query-response protocol that gives information on domain names. Unfortunately, it is not installed by default in cmd.exe but is available in WSL. 

It works by opening a TCP connection (SYN, SYN+ACK), query sent, response sent and a close (FIN, FIN)- very basic indeed. It has no mechanism for indicating character set used, and there has been no effort to support internationalisation in that respect. Historically the predominant encoding used has been US-ASCII.

It has no security provisions. Mechanisms for access control, integrity and confidentiality are excluded.

rdap is a modern alternative to whois. RDAP stands for Registration Data Access Protocol.

No comments: