I think that in low traffic conditions this could lead to counters not being updated. This may confuse users. In other parts of the code we use time for this.

e.g. https://github.com/inliniac/suricata/blob/master/src/source-pcap.c#L279