Whois

Protocol suite:	TCP/IP.
Protocol type:	Application layer directory access protocol.
Port:	43 (TCP) server.
MIME subtype:
SNMP MIBs:
Working groups:
Links:

RFC 3912:

WHOIS is a TCP-based transaction-oriented query/response protocol that is widely used to provide information services to Internet users. While originally used to provide "white pages" services and information about registered domain names, current deployments cover a much broader range of information services. The protocol delivers its content in a human-readable format.

A WHOIS client makes a text request to the WHOIS server, then the WHOIS server replies with text content. All requests are terminated with ASCII CR and then ASCII LF. The response might contain more than one line of text, so the presence of ASCII CR or ASCII LF characters does not indicate the end of the response. The WHOIS server closes its connection as soon as the output is finished. The closed connection is the indication to the client that the response has been received.

MAC header

IP header

TCP header

Whois message

Glossary:

RFCs:

[RFC 2345] Domain Names and Company Name Retrieval.