What steps will reproduce the problem?
1. Script show incorect values for Snort 2.9.0 perfMon output.
2.
3.

What is the expected output? What do you see instead?
mbits_applayer was getting value of bytes_ipfrag.


What version of the product are you using? On what operating system?
Snort 2.9.0

Please provide any additional information below.

Issue is script is twice parsing the value for mbits_ipfrag which makes all 
values to go wrong.

What steps will reproduce the problem?
1. Variable output depending on the options given to perfmon


What is the expected output? What do you see instead?
fields should be parsed with the first line of output of the perfmon (static 
fields should be avoided). The parsing should be done regarding existing fields 
only.

What version of the product are you using? On what operating system?
Latest version (0.60.1?) On linux with snort 2.9.2.2

Please provide any additional information below.
max, when given to perfmon preproc adds fields in the output, which shifts the 
output to the right and invalidates all the parsing.