Suricata

Currently all counters always increment 2 fields: updates and value. This makes no sense for simple counters that just increment with one at a time, like the decoder.pkts counter. For those updates and value will always be the same.

Worse, the decoder.bytes counter will be updated the exact same number of types, so the updates field of this counter will be exactly the same as both fields in decoder.pkts.