with perl, TIMTOWTDI :)

my %current,%last;

my %keys;

map { $keys{$_}; } keys %current, keys %last;

my %changes = ();

foreach my $k (keys %keys) {
  $changes{$k} = $current{$k} unless
      $current{$k} eq $last{$k};
}
[download]

I suppose you could get fancier than that, that'll give you a hash of ips => services if they vary from the previous. Creating the %keys hash allows you to add or subtract ips from your set without causing problems. When you go to act on the %changes hash, just check for an undef() value for that key, if its undef, then decide what to do. If you want to add the ability to stop "watching" an ip's service and leave it as is, you could do this:

my %current,%last,%keys;

foreach my $k (keys %current,keys %last) {
   next unless(exists $current{$k});
   $keys{$k} = 1;
}
[download]

Of course, if you wanted to report the IPs that were removed, you could instead push them onto an array of @removed_ips or something like that. You could do the same for services using values() instead of keys().

Sounds like an interesting project, hope you have fun with it.

-brad..