"Who Is" searches the InterNIC (Internet Network Information Center) Database of registered names allowing you to find the organization and administrative contact responsible for networks with registered domain names or IP addresses.
For example, if you discover a routing problem in accessing "www.sustworks.com", you can use "Who Is" to find out who is responsible for "sustworks.com". The information returned will normally include the email address of an administrative contact to be notified in case of connectivity problems.
From the Trace Route Window, select any destination in the table and press Cmd-Option-W to look up "Who Is" responsible for the corresponding 2nd level network domain.
If the response to a Whois query lists an alternate "Whois Server:", IPNetMonitorX will automatically enter this in the Server Name Field and try the request again. This simplifies using the Whois tool when there are multiple registration authorities for a single top level domain such as ".COM" (server "whois.internic.net" can often be used to find the appropriate whois server and complete the query).
The response to a Whois query will often begin with some standard text such as "NOTICE AND TERMS OF USE..." If you don't wish to see this text repeated in every response, you can copy this text, open the preferences drawer, and paste it into the "Standard text to omit from responses" field. Subsequent Whois results will omit any matching text from the displayed output.
Many international domain names (outside the United States) are not registered by the InterNIC. If a Whois query does not find a matching database entry, you may need to specify an alternate Whois Server by entering the appropriate server address or name. Often, you can find the appropriate Whois Server by entering a Whois query for the top level domain. For example, to lookup who is "liu.se", you would first lookup who is "SE-DOM" (the top level "se" domain). The information returned will usually include one or more references to the domain name of the organization that administers that domain. In our example, this would be "sunet.se" and doing a name server lookup on "whois.sunet.se" returns the address of the appropriate Whois Server.
Whois can also be used for identifying the source of unwanted traffic by searching for the upstream provider (who owns the network range) corresponding to a given IP address. To search for an IP address, use server "whois.arin.net" (American Registry for Internet Numbers).
Whois can be used to search for other information as well. Many Whois servers will provide further instructions if you query for "help" or "?".
When you invoke one window from another, the corresponding data is automatically transferred. Invoke the Ping window from the Window menu (Cmd-Option-P) to begin a ping test to the Whois Server address.
A popup menu keeps a list of Recent Targets or history. The contents of the target field are added to the list when a test to that target is invoked. If the recent targets menu becomes full (10 entries), the least recently used item will be removed. To add or remove an item, or clear the entire list, use the corresponding selections from the History menu. A default list of Whois servers is added each time the application is launched.
You can top-append new results to gather responses from more than one query. Select Top-Append in the preferences drawer, or press Option when invoking a query to override the current setting.
IPNetMonitorX recognizes the 'GURL' AppleEvent to handle URLs of the form:
whois://sustworks.com@whois.internic.net
You can select File->Save to save a double-clickable ".ipnm" document with the corresponding URL. You can preview the URL that will be saved by pausing over the "Save" button in the panel that appears. URLs are saved as plain text. You can include multiple URLs in the same file, one per line, to open the corresponding tools.
You can open and use multiple Who Is windows at the same time.