Whois

From l7protocols
Jump to navigation Jump to search

Whois is a very simple protocol for querying about domain names (and occasionally other things), defined in RFC 3912.

Identification

Ports

Whois servers run on TCP port 43.

l7-filter

l7-filter uses the whois pattern. This is an overmatching pattern, so it should only be used to verify that traffic on port 43 looks like whois, not to attempt to identify whois traffic on other ports.

See also