Now just add a ^ anchor at the front of the regex and you've got a nice solution for the regex (otherwise backtracking will be attempted, wasting time). Note that (?!TCP) only prevents matching against fields that start with "TCP". So you might want (?!TCP\s) instead (and don't chomp).

                - tye