I have a Unix box so I can't test the regexp after modification. So I have to better explain the motivations behind the modified regex if it needs further tweaking.

First avoid .* that is greedy and leads to uneeded backtracking or may lead to match more than intended. .*? is the non greeedy equivalent. Better, be more specific in your regexps. Here, using \S+ make you sure to capture only non blanks.

I have added the x modifier to your regexp to vertically align your regexp with mine. Also, I don't know the format output from your netstat so I defensively added \s* around colons in case there is indeed blanks around colons in the input. They may not be needed.
Also I used (\S+) to make clear that I expect non empty capture. If some capture may be empty use (\S*) instead.

/^\s+(.*) \s+(.*)    :   (.*)\s+ (.*)    :   (.*)\s+ (.*)/x

/^\s+(\S+)\s+(\S+)\s*:\s*(\S+)\s+(\S+)\s*:\s*(\S+)\s+(\S+)/
[download]

Then there is the temptation to factorize:

my $qr = q|(\S+)\s+(\S+)\s*:\s*(\S+)|;
[download]

The regexp would become: <code>/^\s+$qr\s+$qr\s+(\S+)/<code>

But you can't do it because the captures done by $qr are invisible from the regexp where it is interpolated.

-- stefp -- check out TeXmacs wiki