# Scan for source/dest pairs and count hits on each dest: $ipregex = qr/(?:\d{1,3}\.){3}\d{1,3}/; open(CAP, "$file"); while() { if ( /\s+($ipregex)\s+->($ipregex)\s+/ ) { $dest{$2}++; } } close CAP;