WHO documentation, updated on 02 Jan 1999.

Since ircu2.10.02 the WHO command had been changed from what described in RFC1459, while still keeping backward compatibility, actually it has been changed again in u2.10.05 so that since this release the format of the who query is now:

[:source] WHO <mask1> [<options> [<mask2>]]

<mask2> is optional, if mask2 is present it's used for matching and mask1 is ignored, otherwise mask1 is used for matching, since mask2 is the last parameter it *can* contain a space and this can help when trying to match a "realname".

When matching IP numbers the <mask> can be in 3 forms:

Note that:

For all the other fields the match happens as has always been, i.e. it's only considered the IRC mask with * and ? (that is: don't expect to catch a user with "realname" = "" when doing "/who 1.2/16 h" :)

For both the masks and the options (and thus for all flags) case is NOT significative (so "/who <any> o" is exactly the same as "/who <ANY> O".

The "options2 part can be as follows:


in which:

<flags>: can be a sequence of field matching flags, use mode matching flags and special purpose flags

Field matching flags, when one of these is specified the field in question is matched against the mask, otherwise it's not matched.

Nick (in nick!user@host)
Username (in nick!user@host)
Hostname (in nick!user@host)
Numeric IP (the unresolved host)
Servername (the canonic name of the server the guy is on)
Info text (formerly "Realname")

If no field-matching flags are specified they default to what old servers used to do: nuhsr (= everything except the numeric IP)

User mode matching flags (specifying one of these means that only clients with that umode are considered, what is not specified is always matched):

Irc operator
[In the future more flags will be supported, basically all usermodes plus the +/- specificators to revert the filtering] Special purpose flags:
If this is specified the extended visibility of information for opers is applied, what this means depends on the fact that you are local or global operator and on how the admin configured the server (global and eventually local irc opers might be allowed with this flag to see +i local users, to see all +i users, to see users into +p and/or +s channels, and so on). Using the 'x' flag while not beeing irc operator is meaningless (it will be ignored), using it while oper'd means that the query is almost certainly logged and the admin might (rightfully) ask you an explanation on why you did.

The rest, what follows the %, that is [%[fields[,<querytype>]]], is as it has always been since the first who.patch, the <fields> part specifies which fields to include in the output as:

  c : Include (first) channel name
  d : Include "distance" in hops (hopcount)
  f : Include flags (all of them)
  h : Include hostname
  i : Include IP
  n : Include nick
  r : Include real name
  s : Include server name
  t : Include the querytype in the reply
  u : Include userID with eventual ~

And the ,<querytype> final option can be used to specify what you want the server to say in the querytype field of the output, useful to filter the output in scripts that do a kind of "on 354 ..."

If no %fields are specified the reply is exactly the same as has always been, numeric 352, same fields, same order.

If one or more %fields are specified the reply uses a new numeric, since an out-of-standard 352 crashes EPIC and confuses several other clients. I used 354.

:"source" 354 "target" ["querytype"] ["channel"] ["user"] 
                       ["IP"] ["host"] ["server"] ["nick"] 
                       ["flags"] ["hops"] [:"realname"]

Where only the fields specified in the %fields options are present.

"querytype" is the same value passed in the /who command, it is provided to simplify scripting, in example one could pass a certain value in the query and have that value "signal" back what is to be done with those replies.

The number of lines in the reply is still limited to avoid self-flooding and sooner or later another limitation will be added: you will be forced to do no more than one /who query every 'n' seconds where 'n' depends on the number of fields you actually match (the field-match flags specified before % in the option, defaulting to 6 if you don't specify an option at all), infact matching against many fields as the default query does severely affects the CPU usage of the server and is *much* better to specify with the field-atching flags what you are looking for, in example when you are looking for all french users a "/who *.fr h" is A LOT better than just "/who *.fr" (and actually you want users that have the hostname matching *.fr, you wouldn't want to match a japanese user that has the realname "ku fung-kay aj.fr" in example...)

Note that:

The actual "mask" to match can have one of the two following forms:

Miscellaneous bug fixes / "undocumented feature" changes:

Regards, Andrea aka Nemesi