Besides that I can confirm that this happens even on some of the suricata-verify tests. We created a bug tracking ticket for that at our redmine, see Bug #5811: SMB events sometimes have duplicate `tree_id` output. - Suricata - Open Information Security Foundation