Suricata

Inside PrintRawUriFp() we perform write operations of 1 character length. This is used by some of the output modules.

This means that for each character on a payload we will be doing a syscall of just 1 char as long as the lenght is. When writing to files, this will make the performance lower because of all the context switching. Potential fix: do a tmp copy of the buffer adjusting printable and non printable characters, and make only 1 write operation with it. Then free the tmp buffer (the copy plus 1 write should be less cost than 1 write per character).