owasp-amass/amass · error

failed to establish a connection with the WHOIS server: %v

Error message

failed to establish a connection with the WHOIS server: %v

What it means

The bgptools WHOIS plugin wraps the underlying TCP dial error when it cannot establish a connection to its WHOIS service (host/port from plugin config, dialed with a 3s dialer inside a 10s overall timeout). It is a network-connectivity failure of the outbound TCP connection to the bgp.tools WHOIS endpoint, surfaced from the plugin's internal `whois` method.

Source

Thrown at engine/plugins/whois/bgptools/plugin.go:141

	IP            netip.Addr
	Prefix        netip.Prefix
	CC            string
	Registry      string
	AllocatedDate time.Time
	ASName        string
}

func (bt *bgpTools) whois(ctx context.Context, ipstr string) (*bgpToolsRecord, error) {
	dial := amassnet.NewDialContext(3 * time.Second)
	addr := net.JoinHostPort(bt.addr, strconv.Itoa(bt.port))

	_ = bt.rlimit.Wait(ctx)
	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
	defer cancel()

	conn, err := dial(ctx, "tcp", addr)
	if err != nil {
		return nil, fmt.Errorf("failed to establish a connection with the WHOIS server: %v", err)
	}
	defer func() { _ = conn.Close() }()

	n, err := io.WriteString(conn, fmt.Sprintf("begin\n%s\nend", ipstr))
	if err != nil || n == 0 {
		return nil, fmt.Errorf("failed to send the request to the WHOIS server: %v", err)
	}

	data, err := io.ReadAll(conn)
	if err != nil {
		return nil, fmt.Errorf("error reading the response from the WHOIS server: %v", err)
	}

	record := strings.Split(string(data), "|")
	// Ensure the record contains the necessary details (AutonomousSystem and Netblock)
	if len(record) < 7 {
		return nil, errors.New("received insufficient data from the WHOIS server")
	}

View on GitHub (pinned to 79299dce87)

Solutions

1. Verify outbound TCP connectivity to the configured WHOIS host/port (e.g. `nc -vz <host> <port>`) and fix network/firewall/proxy rules
2. Check the plugin's configured server address (bt.addr/bt.port) for typos or stale values
3. Confirm DNS resolution works in the environment; test with `dig`/`nslookup`
4. Retry later or switch to an alternate WHOIS data source plugin if bgp.tools is down
5. Check the wrapped cause (`%v` of the dial error) to distinguish DNS failure, timeout, and connection refused

Example fix

// before
addr := net.JoinHostPort("whois.bgp.tools", "43") // wrong host hardcoded/typo
// after
addr := net.JoinHostPort(bt.addr, strconv.Itoa(bt.port)) // validated config, port 43 reachable

// before querying
func canReachWhois(host string, port int) bool {
    conn, err := net.DialTimeout("tcp", net.JoinHostPort(host, strconv.Itoa(port)), 3*time.Second)
    if err != nil { return false }
    _ = conn.Close()
    return true
}

errgroup-style retry with backoff:
var rec *bgpToolsRecord
for attempt := 0; attempt < 3; attempt++ {
    rec, err = plugin.Query(ctx, ip)
    if err == nil { break }
    if !isNetworkErr(err) { return err } // don't retry non-network failures
    time.Sleep(time.Duration(1<<attempt) * time.Second)
}

When it happens

Trigger: Calling the plugin's query path, which invokes whois(ctx, ipstr): the TCP dial to bt.addr:bt.port fails — the server is down, DNS for bt.addr fails, the network is unreachable, a firewall drops the connection, or the 10s context timeout expires before the dial completes.

Common situations: No outbound internet access or blocked port 43 in sandboxes/CI containers; the configured WHOIS server address is wrong or points to a host that no longer resolves; the bgp.tools service is temporarily unavailable; corporate proxies/firewalls that only allow HTTP(S).

Understand the failure class

Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.

Related errors

• error reading the response from the WHOIS server: %v
• failed to send the request to the WHOIS server: %v
• failed to create the connection to the log server: %v
• probes were not successful against the target
• failed to obtain the BGPTools IP address

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/83a918f0f3da7846. Report an issue: GitHub.