I am using rkhunter 1.4.2 on CentOS 6.5.A message, in /var/log/rkhunter.log isWarning: The file properties have changed:[09:40:35]          File: /sbin/ip[09:40:35]          Current size: 247396    Stored size: 247300[09:40:35]          Current file modification time: 1415276490 (06-Nov-2014 07:21:30)[09:40:35]          Stored file modification time : 1401361583 (29-May-2014 07:06:23)I used ip -V  and got  ip -V  ip utility, iproute2-ss091226which seems to imply it is part of a package from 2009.  I tried to reinstall iproute2 and got the following result.$ sudo yum install iproute2Loaded plugins: fastestmirror, refresh-packagekit, securitySetting up Install ProcessLoading mirror speeds from cached hostfile * atomic: www.atomicorp.com * base: mirror.lug.udel.edu * epel: mirror.nexcess.net * extras: mirrors.lga7.us.voxel.net * rpmforge: repoforge.mirror.constant.com * updates: ftpmirror.your.orgNo package iproute2 available.Error: Nothing to doI got the MD5 for /sbin/ip as follows$ md5sum /sbin/ipf86d18c6c94096baf9dc6623e9fbe615  /sbin/ipA google search for that MD5 yielded no results so I cannot tell it if corresponds to a legitimate version of /sbin/ip.
rkhunter reports /sbin/ip has changed
centos;rkhunter
The package in question is iproute not iproute2 on CentOS.Without including the architecture, it is hard for others to verify the md5 sum of your executable.  One way to check is to, from a machine you trust, manually pull down the rpm from the centos mirrors, unpack it, and look at the files.When I do this for the latest versions on mirror.centos.org (2.6.32-33), I get:x86_64 2d08ea6c0e0e8360f7618ba549101fb8  /sbin/ip  i386 d9bea3a3fda11e9b3822f796601e75d0  /sbin/ipNeither of which matches yours.  If you have concerns, you obviously may want to nuke the machine from orbit. My hunch is that iproute was recently updated.  Looking at the date for the iproute package here:http://mirror.centos.org/centos/6/updates/x86_64/Packages/There is a package with last modified time of 06-Nov-2014 14:07.  The fact that your md5sum for this executable doesn't match the above could mean that (0) you have a compromised executable, (1) you aren't updated to the version I checked, (2) you pulled from a local mirror where some administrator rebuilt the package with site-specific compilation flags, (3) the RPM installation went wrong and your executable is wrong because of a failed unpacking or some other error. Or other options I'm sure.You can also try  rpm -V -f /sbin/ip to verify the file against the RPM database.  However, if you have a reason to believe the machine was compromised, doing analysis of it with tools on that same machine is also a bit suspect, since any of them could have been modified to lie to you.