What is a black hole as referenced in the following log?

I found this text within a file on my iMac under the name "route", in the sbin. It appears to be an attempt to change my network interface but I'm afraid I can only speculate I've turned to you. could this be an Apple file or perhaps from Time Warner... Or perhaps indeed a malicious code? Any information you could provide would be greatly appreciated.



add black hole change cloning deleted st expire flush gateway gen mask get host hopcount iface interface if aifpineti net6 Iso link ll info lock lock

rest mask monitor mtu net net mask no static osiprefix lenproto1proto2 recvpipe reject rttrttvarsa send pipessthresh static x25xnsx resolve if scope bad

keyword: %susage: route [-dnqtv] command [[modifiers] args]

nqdtv/dev/null socket must be root to alter routing table route-sysctl-estimate malloc failed route-sysctl-get write to routing socket got only %d for rlen

%-20.20s default%u.%u.%u.%uinvalid(%d) %x%u%u.%u%u.%u.%uaf %d:bad interface name invalid mask: %s%s %s %s: gateway %s (%s): %s

get if addrs internal error%s: %s

bad address: %sprefixlen not supported in this af

%s: bad value

actual retrieval of interface table

got message of size %d on %suwriting to routing socket: %sread from routing socketRTM_ADD: Add Route RTM_DELETE: Delete Route RTM_CHANGE: Change

Metrics or flagsRTM_GET: Report Metrics RTM_LOSING: Kernel Suspects PartitioningRTM_REDIRECT: Told to use different routeRTM_MISS: Lookup failed

on this addressRTM_LOCK: fix specified metricsRTM_OLDADD: caused by SIOCADDRTRTM_OLDDEL: caused by SIOCDELRTRTM_RESOLVE: Route

created by cloning RTM_NEWADDR: address being added to ifaceRTM_DELADDR: address being removed from iface RTM_IF INFO: iface status change

RTM_NEWMADDR: new multicast group membership on iface RTM_DELMADDR: multicast group membership removed from iface routing message version

%d not understood

%s: len %d, if# %d, flags:metric %d, flags:pid: %ld, seq %d, errno %d, ifscope %d, ifref, flags: route to: %s

routing message version %d not understood message length mismatch, in packet %d, returned %dmessage indicates error %ddestination: %s

mask: %s

gateway: %s

interface: %.*s

flags: %s

recvpipe sendpipe ssthresh rtt, msec rttvar hopcount mtu expire%8u%c %8d%c

sockaddrs:

locks: inits:

sockaddrs: %s%s: link %s; %s: inet %s; 064128 not in table entry in use routing table overflow done Examining routing table from sysctl00—Xa

ºHH3HTG,!

¿£„„Î"ù#%€(G)*≈*+\+!ú4¶4∞4∫4ƒ4Œ4ÿ4‚4Ï4ˆ45

555(525<5F5P5Z5d5n5x5Ç5å5ñ5†5™5¥5æ5»5“5‹5Ê55˙5666"6,666@6J6T6^6h6r6|6Ü6ê6ö6§6Æ6 ∏6¬6Ã6÷6‡6Í6Ù677777$7(7/757 =7

E7

I7N7

pksent rttvarrttssthresh send pipe recvpipe expire hop count mtu UPGATEWAY HOST REJECT DYNAMIC MODIFIED DONE DELCLONE CLONING

XRESOLVE

LL INFO STATIC

BLACKHOLE b016 PROTO2 PROTO1 PR CLONING WAS CLONED PROTO3b024 PINNED LOCAL BROADCAST MULTICAST IF SCOPE CONDEMNED

IF REF PROXY ROUTER UP BROADCAST DEBUG LOOPBACK PTPb6 RUNNING NO ARP PPRO MISC

ALL MULTI

OACTIVE SIMPLEX

LINK0 LINK1 LINK2 MULTICAST DST GATEWAY NETMASK GENMASK IFPIFA AUTHOR BRD"0`=AÄ-p(`@___stack_chk_guardQrê@___stderrpê@

___stdoutpê@_optindê@dyld_stub_binderÄ–ˇˇˇˇˇˇˇˇêr0@___bzeroêr8@___errorêr@@___me mcpy_chkêrH@___memmove_chkêrP@___snprintf_chkêrX@___

stack_chk_failêr`@___strlcpy_chkêrh@_atoiêrp@_bcopyêrx@_ctimeêrÄ@_errêrà@_errxêr ê@_exitêrò@_fflushêr†@_fprintfêr®@_freeaddrinfoêr∞@

_freeifaddrsêr∏@_fwriteêr¿@_gai_strerrorêr»@_getaddrinfoêr–@_geteuidêrÿ@_gethost byaddrêr‡@_gethostbynameêrË@_gethostnameêr@_getifaddrsêr¯@

_getnameinfoêrÄ@_getnetbyaddrêrà@_getnetbynameêrê@_getoptêrò@_getpidêr†@_if_name toindexêr®@_indexêr∞@_inet_addrêr∏@_inet_lnaofêr¿@_

inet_networkêr»@_inet_ntoaêr–@_link_addrêrÿ@_link_ntoaêr‡@_mallocêrË@_memcpyêr@ _memsetêr¯@_openêrÄ@_printfêrà@_putcêrê@_putcharêrò@_

putsêr†@_readêr®@_setuidêr∞@_shutdownêr∏@_socketêr¿@_strchrêr»@_strcmpêr–@_strerrorêrÿ@_strlenêr‡ @_strncpyêrË@_strtoulêr@_sysctlêr¯@

_timeêrÄ@_warnêrà@_warnxêrê@_writeê__mh_execute_headerº@AB__mh_execute_header___bzero___error___memcpy_chk___memmove_chk__

_snprintf_chk___stack_chk_fail___stack_chk_guard___stderrp___stdoutp___strlcpy_c hk_atoi_bcopy_ctime_err_errx_exit_fflush_fprintf_freeaddrinfo_

freeifaddrs_fwrite_gai_strerror_getaddrinfo_geteuid_gethostbyaddr_gethostbyname_ gethostname_getifaddrs_getnameinfo_getnetbyaddr_getnetbyname_

getopt_getpid_if_nametoindex_index_inet_addr_inet_lnaof_inet_network_inet_ntoa_l ink_addr_link_ntoa_malloc_memcpy_memset_open_optind_printf_

putc_putchar_puts_read_setuid_shutdown_socket_strchr_strcmp_strerror_strlen_strn cpy_strtoul_sysctl_time_warn_warnx_writedyld_stub_binderradr://5614542˙

fi¿M$D˙fi‡h0]‡com.apple.rout

iMac, iOS 9.3.2

Posted on Jun 4, 2016 4:11 AM

Reply
17 replies

Jun 4, 2016 3:24 PM in response to Clogan75

Can anyone comment about this? can you at least tell me if this is a standard file that Apple or a service provider would use? In case you haven't noticed, I separated many of the words within the script... It was easier to read... Here's the text unchanged;



H__PAGEZEROÿ__TEXT@@__text__TEXTº`,ºÄ__stubs__TEXT3n3Ä__stub_helper__TEXTå4rå4Ä_ _cstring__TEXT7T7__unwind_info__TEXTT?†T?(__DATA@ @__nl_symbol_ptr__DATA@@=__got__DATA@ @?__la_symbol_ptr__DATA0@Ë0@C__data__DATA B` B__bss__DATAÄG(__common__DATA®J‰H__LINKEDIT`0P∞""Ä0PP`pPpT ÿTD[»

PBYÄ /usr/lib/dyldpËy/1R±6‡+ãßÕ$

(Ä8Ω/usr/lib/libSystem.B.dylib



addblackholechangecloningdeletedstexpireflushgatewaygenmaskgethosthopcountifacei nterfaceifaifpinetinet6isolinkllinfolocklockrestmaskmonitormtunetnetmasknostatic osiprefixlenproto1proto2recvpiperejectrttrttvarsasendpipessthreshstaticx25xnsxre solveifscopebad keyword: %susage: route [-dnqtv] command [[modifiers] args]

nqdtv/dev/nullsocketmust be root to alter routing tableroute-sysctl-estimatemalloc failedroute-sysctl-getwrite to routing socketgot only %d for rlen

%-20.20s default%u.%u.%u.%uinvalid(%d) %x%u%u.%u%u.%u.%uaf %d:bad interface nameinvalid mask: %s%s %s %s: gateway %s (%s): %s

getifaddrsinternal error%s: %s

bad address: %sprefixlen not supported in this af

%s: bad value

actual retrieval of interface table

got message of size %d on %suwriting to routing socket: %sread from routing socketRTM_ADD: Add RouteRTM_DELETE: Delete RouteRTM_CHANGE: Change Metrics or flagsRTM_GET: Report MetricsRTM_LOSING: Kernel Suspects PartitioningRTM_REDIRECT: Told to use different routeRTM_MISS: Lookup failed on this addressRTM_LOCK: fix specified metricsRTM_OLDADD: caused by SIOCADDRTRTM_OLDDEL: caused by SIOCDELRTRTM_RESOLVE: Route created by cloningRTM_NEWADDR: address being added to ifaceRTM_DELADDR: address being removed from ifaceRTM_IFINFO: iface status changeRTM_NEWMADDR: new multicast group membership on ifaceRTM_DELMADDR: multicast group membership removed from ifacerouting message version %d not understood

%s: len %d, if# %d, flags:metric %d, flags:pid: %ld, seq %d, errno %d, ifscope %d, ifref, flags: route to: %s

routing message version %d not understoodmessage length mismatch, in packet %d, returned %dmessage indicates error %ddestination: %s

mask: %s

gateway: %s

interface: %.*s

flags:

%s

recvpipe sendpipe ssthresh rtt,msec rttvar hopcount mtu expire%8u%c %8d%c

sockaddrs:

locks: inits:

sockaddrs: %s%s: link %s; %s: inet %s; 064128not in tableentry in userouting table overflowdoneExamining routing table from sysctl00—Xa

ºHH3HTG,!

¿£„„Î"ù#%€(G)*≈*+\+!ú4¶4∞4∫4ƒ4Œ4ÿ4‚4Ï4ˆ45

555(525<5F5P5Z5d5n5x5Ç5å5ñ5†5™5¥5æ5»5“5‹5Ê55˙5666"6,666@6J6T6^6h6r6|6Ü6ê6ö6§6Æ6 ∏6¬6Ã6÷6‡6Í6Ù677777$7(7/757 =7

E7

I7N7

pksentrttvarrttssthreshsendpiperecvpipeexpirehopcountmtuUPGATEWAYHOSTREJECTDYNAM ICMODIFIEDDONEDELCLONE CLONING

XRESOLVE

LLINFOSTATIC

BLACKHOLEb016PROTO2PROTO1PRCLONINGWASCLONEDPROTO3b024PINNEDLOCALBROADCASTMULTICA STIFSCOPECONDEMNEDIFREFPROXYROUTERUPBROADCASTDEBUGLOOPBACKPTPb6RUNNINGNOARP PPROMISC

ALLMULTI

OACTIVESIMPLEX

LINK0LINK1LINK2MULTICASTDSTGATEWAYNETMASKGENMASKIFPIFAAUTHORBRD"0`=AÄ-p(`@___sta ck_chk_guardQrê@___stderrpê@___stdoutpê@_optindê@dyld_stub_binderÄ–ˇˇˇˇˇˇˇˇêr0@_ __bzeroêr8@___errorêr@@___memcpy_chkêrH@___memmove_chkêrP@___snprintf_chkêrX@___ stack_chk_failêr`@___strlcpy_chkêrh@_atoiêrp@_bcopyêrx@_ctimeêrÄ@_errêrà@_errxêr ê@_exitêrò@_fflushêr†@_fprintfêr®@_freeaddrinfoêr∞@_freeifaddrsêr∏@_fwriteêr¿@_g ai_strerrorêr»@_getaddrinfoêr–@_geteuidêrÿ@_gethostbyaddrêr‡@_gethostbynameêrË@_ gethostnameêr@_getifaddrsêr¯@_getnameinfoêrÄ@_getnetbyaddrêrà@_getnetbynameêrê@ _getoptêrò@_getpidêr†@_if_nametoindexêr®@_indexêr∞@_inet_addrêr∏@_inet_lnaofêr¿@ _inet_networkêr»@_inet_ntoaêr–@_link_addrêrÿ@_link_ntoaêr‡@_mallocêrË@_memcpyêr @_memsetêr¯@_openêrÄ@_printfêrà@_putcêrê@_putcharêrò@_putsêr†@_readêr®@_setuidêr ∞@_shutdownêr∏@_socketêr¿@_strchrêr»@_strcmpêr–@_strerrorêrÿ@_strlenêr‡@_strncpy êrË@_strtoulêr@_sysctlêr¯@_timeêrÄ@_warnêrà@_warnxêrê@_writeê__mh_execute_heade rº

@AB__mh_execute_header___bzero___error___memcpy_chk___memmove_chk___snprintf_chk ___stack_chk_fail___stack_chk_guard___stderrp___stdoutp___strlcpy_chk_atoi_bcopy _ctime_err_errx_exit_fflush_fprintf_freeaddrinfo_freeifaddrs_fwrite_gai_strerror _getaddrinfo_geteuid_gethostbyaddr_gethostbyname_gethostname_getifaddrs_getnamei nfo_getnetbyaddr_getnetbyname_getopt_getpid_if_nametoindex_index_inet_addr_inet_ lnaof_inet_network_inet_ntoa_link_addr_link_ntoa_malloc_memcpy_memset_open_optin d_printf_putc_putchar_puts_read_setuid_shutdown_socket_strchr_strcmp_strerror_st rlen_strncpy_strtoul_sysctl_time_warn_warnx_writedyld_stub_binderradr://5614542˙ fi¿M$D˙fi‡h0]‡com.apple.rout

Jun 4, 2016 3:55 PM in response to Clogan75

/sbin/route is a legitimate piece of the OS. It's a binary executable file that is protected by the SIP system. The part of the contents you've found are the the format strings used to construct output.


It's fine. Leave it alone. If some 'antivirus utility' has drawn your attention this file, delete the antivirus utility.


C.

Jun 4, 2016 6:47 PM in response to macjack

Thank you for the reply, I know that the "route" file is to be expected but I've noticed the same thing you did, I've looked at the route in other computers and they are not the same. The scary part is that it's on my home computer. Can you tell me anything about what it says? I had someone else tell me that it looks like an attempt to reroute the route table and make changes to the network interface settings. I have a good idea of how null routes and black hole filtering are used and youll have to forgive me for saying this to the other person who responded but I think you might be mistaken about Apples use of this code as it appears here.

Jun 4, 2016 8:47 PM in response to macjack

Thank you again for your reply, can you direct me to the proper forum for more information? I couldn't locate a "programming" forum when I posted this. It's very important that I confirm that this is not Apple code with Apple before I do anything else. I understand completely that it's within a proper Apple directory. I thought they might be interested in this anyway.

Jun 5, 2016 2:12 AM in response to Clogan75

I can assure you that the text you quote is in /sbin/route all three examples of OS X 10.11.5 installations I've checked and I can guarantee that these are 'clean'. I used both a binary editor and strings(1) and checked clean images. If you or the others 'advising' you understood what route(8) does it would be obvious to them that the strings are necessary for it to perform its function, which is to manually manipulate routing tables.


C.

Jun 5, 2016 8:18 AM in response to cdhw

So Apple employs black hole filtering? Can you help me understand when dropping packets is necessary from a code perspective? I don't mean to offend anyone here, I simply would like to know why my home network is dropping units of data. No need to get into it here but I am currently involved in a serious legal matter and I have very good reason to be concerned.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

What is a black hole as referenced in the following log?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.