-e·--enrich·--annotateEnrich every IP address in your output.
Pipe a traceroute, a firewall log, an alert, a paste — anything — through whob -e, and every IPv4 or IPv6 address comes back followed by the autonomous system that announces it, straight from the live global routing table. The text is otherwise untouched. WhoB ships in every LFT tarball.
$ lft -n eggs.gnu.org:587 | whob -e 1 192.0.2.1 [?] 0.412 ms 2 * 3 * 4 * 5 198.32.160.208 [?] 2.104 ms 6 198.160.63.126 [AS27552 TowardEX Technologies International, Inc.] 7.331 ms 7 198.160.62.201 [AS27552 TowardEX Technologies International, Inc.] 7.402 ms 8 206.53.143.61 [?] 7.288 ms 9 209.51.188.92 [AS22989 Hurricane Electric LLC] 7.412 ms
The eggs.gnu.org trace from lft(8), piped through whob -e. [?] means no route in the table — exchange-point and private addresses.
Who is knocking?
Every address is looked up once, however many times it appears; ports, prefixes and bracketed IPv6 stay attached to their addresses. Output is colorized on a terminal and plain in a pipe, so the same command works interactively and in a cron job.
$ grep DROP /var/log/firewall.log | whob -e Sep 5 03:12:44 fw kernel: DROP IN=eth0 SRC=45.148.10.77 [AS48090 DMZHOST] DST=203.0.113.5 [?] PROTO=TCP DPT=22 Sep 5 03:12:45 fw kernel: DROP IN=eth0 SRC=185.220.101.34 [AS60729 Network for Tor-Exit traffic.] DST=203.0.113.5 [?] PROTO=TCP DPT=22 Sep 5 03:12:47 fw kernel: DROP IN=eth0 SRC=8.8.8.8 [AS15169 Google LLC] DST=203.0.113.5 [?] PROTO=UDP DPT=53 # which networks are knocking? tally the tags $ grep DROP /var/log/firewall.log | whob -e | grep -oE 'AS[0-9]+ [^]]+' | sort | uniq -c | sort -rn
Log lines are a sample; the tags are what WhoB returned for those addresses.
-FSay how much to say.
The default tag is [ASn Org-Name]. -F takes a list of asn, org, asorg, net, prefix, city, region, country, cc, place, all; a leading + or - adjusts the default instead of replacing it.
$ echo "x 4.2.2.1 y" | whob -e -F +net x 4.2.2.1 [AS3356 Level 3 Parent, LLC LVLT-ORG-4-8] y $ echo "x 4.2.2.1 y" | whob -e -F place x 4.2.2.1 [Atlanta, Georgia, United States of America (US)] y $ echo "2001:4860:4860::8888 and [2606:4700:4700::1111]:53" | whob -e 2001:4860:4860::8888 [AS15169 Google LLC] and [2606:4700:4700::1111]:53 [AS13335 Cloudflare, Inc.] $ echo "192.168.1.1" | whob -e 192.168.1.1 [?]
Ask about one address.
With no options, whob sends your query to the pWhoIs server as typed and prints the answer exactly as the server returned it — the full record, nothing parsed. That is the default because people asked for it.
Add -g and WhoB parses the record down to a single line: address, origin AS with its announced prefix, and organization. Build the line up from there: -n network name, -p the AS path from the server's vantage, -R the RADB origin beside the routing-table origin, -t when the route was last cached. Switch sources with -r (RIPE RIS) or -c (Team Cymru), or point -h at any pWhoIs-compatible server. whob me prints your public address.
Ask bigger questions
| -a ASN | Every prefix the AS originates |
| -A ASN | Every prefix transiting the AS |
| -P prefix | Everything related to a CIDR prefix |
| -N ASN | Networks registered to the AS |
| -O ASN | Contact information on file for the AS |
| -f file | Bulk lookups, one address per line (-f - reads stdin); -C for bulk via Cymru |
| -s | Version and status of the pWhoIs server |
$ whob 4.2.2.1 # the full Prefix WhoIs record, unparsed IP: 4.2.2.1 Origin-AS: 3356 Prefix: 4.0.0.0/9 AS-Path: 8220 1299 3356 AS-Org-Name: Level 3 Parent, LLC Org-Name: Level 3 Parent, LLC Net-Name: LVLT-ORG-4-8 Cache-Date: Sep 05 2026 07:17:28 City: Atlanta Region: Georgia Country-Code: US Route-Originated-Date: Aug 11 2026 15:08:25 … $ whob -g 4.2.2.1 # -g: parse it down to one line 4.2.2.1 | origin-as 3356 (4.0.0.0/9) | Level 3 Parent, LLC $ whob -gnp 4.2.2.1 # add net name and AS path 4.2.2.1 | origin-as 3356 (4.0.0.0/9) | as-path 8220 1299 3356 | LVLT-ORG-4-8 | Level 3 Parent, LLC $ whob -gR 4.2.2.1 # compare the RADB origin 4.2.2.1 | origin-as 3356 (4.0.0.0/9) | radb-as 3356 | Level 3 Parent, LLC $ whob -gr 4.2.2.1 # ask RIPE RIS instead 4.2.2.1 | origin-as 3356 (4.0.0.0/9) | LEVEL3 - Level 3 Parent, LLC, US
The AS that announces it
WhoB's origin AS comes from the global routing table as Prefix WhoIs sees it — what is actually being announced — with the registry's RADB origin available beside it for comparison.
The same library LFT uses
Single and bulk pWhoIs queries, plus ARIN, RIPE, APNIC, RADB, Cymru and RIS with recursive resolution — in whois.h.
Try it from the browser
The web lookup answers the same question from the same server, for one address at a time.