owasp-amass/amass · warning

received insufficient data from the WHOIS server

Error message

received insufficient data from the WHOIS server

What it means

The bgptools WHOIS query (whois method) parses the server's pipe-delimited response by splitting on '|'. If fewer than 7 fields come back, the record cannot contain both the AutonomousSystem and Netblock data the parser requires, so it returns errors.New("received insufficient data from the WHOIS server"). The response format deviates from what the plugin expects.

Source

Thrown at engine/plugins/whois/bgptools/plugin.go:158

	if err != nil {
		return nil, fmt.Errorf("failed to establish a connection with the WHOIS server: %v", err)
	}
	defer func() { _ = conn.Close() }()

	n, err := io.WriteString(conn, fmt.Sprintf("begin\n%s\nend", ipstr))
	if err != nil || n == 0 {
		return nil, fmt.Errorf("failed to send the request to the WHOIS server: %v", err)
	}

	data, err := io.ReadAll(conn)
	if err != nil {
		return nil, fmt.Errorf("error reading the response from the WHOIS server: %v", err)
	}

	record := strings.Split(string(data), "|")
	// Ensure the record contains the necessary details (AutonomousSystem and Netblock)
	if len(record) < 7 {
		return nil, errors.New("received insufficient data from the WHOIS server")
	}

	var r bgpToolsRecord
	for i, f := range record {
		field := strings.TrimSpace(f)

		switch i {
		case 0:
			num, err := strconv.Atoi(field)
			if err != nil {
				return nil, err
			}
			r.ASN = num
		case 1:
			ip, err := netip.ParseAddr(field)
			if err != nil {
				return nil, err
			}

View on GitHub (pinned to 79299dce87)

Solutions

1. Verify the queried IP/ASN is one bgp.tools has data for (test with whois -h bgp.tools <ip>).
2. Retry later — rate-limit or transient server issues may cause short/invalid responses.
3. Check the raw WHOIS response manually to see whether bgp.tools changed its field layout, and update the parser expectations if so.
4. Handle the error per-record: skip the asset and continue enumeration instead of aborting.

Example fix

// before
record := strings.Split(string(data), "|")
if len(record) < 7 {
    return nil, errors.New("received insufficient data from the WHOIS server")
}
// after
record := strings.Split(string(data), "|")
if len(record) < 7 {
    log.Warn("bgptools WHOIS response too short, skipping", "fields", len(record), "raw", string(data))
    return nil, nil // skip this record instead of failing
}

// Pre-check the raw WHOIS shape before parsing
data, err := queryWhois(addr)
if err != nil { return err }
if strings.Count(string(data), "|") < 6 {
    return fmt.Errorf("malformed bgptools response: %q", string(data))
}

rec, err := whois(ip)
if err != nil && strings.Contains(err.Error(), "received insufficient data") {
    log.Warn("skipping asset: short bgptools record", "ip", ip)
    return nil
}

When it happens

Trigger: Calling the plugin's whois lookup for an IP/ASN and the WHOIS server replies with a pipe-separated line with len(strings.Split(data, "|")) < 7 — error pages, empty responses, or format changes all trigger it.

Common situations: Querying an IP or ASN with no bgp.tools record; WHOIS server rate-limiting or returning an error banner; bgp.tools changing its response format; connection returning truncated/partial data.

Understand the failure class

Background: "invalid response format", "malformed payload", "missing data field": when an API returns 200 but the response shape is wrong — this error's family across 23 libraries.

Related errors

• failed to obtain the BGPTools IP address
• failed to unmarchal the JSON
• unable to parse database URI query parameters: %v
• invalid port string: %v
• invalid start port: %v

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/3c814ecf71dd70ae. Report an issue: GitHub.