Was checking my Intrusion Prevention section in the System Logs and noticed that I’m getting an error message “suricata SSSE3 support not detected, disabling Hyperscan for MPM”.
Question - Is this an indication that the Intrusion Prevention System is effectively disabled even though its enabled and running?
Fireinfo setting under System Information shows support for SSE, SSE2, SSSE3 , and SSE4A.
My Fireinfo profile ID is “5225e1ac11735e3305c1765e4a47b0e28cc852c0”.
I’m running level 197.
Hello Harold,
this message is indeed a little bit misleading, but it does not mean that your IPS is not running well.
Since we switched to vectorscan, the accelerated pattern matching library requires SSE4.2. There is a check function that Suricata calls whether the platform is supported, but they still print the older (Hyperscan) requirement of SSSE3.
Your IPS will run just as well, but it won’t use the accelerated functions which require more modern instructions sets.
Thank you so much for your quick reply and explanation.
Best regards………Harold