Many thanks to everyone who posted help! After leaving it for a while, I realized I needed to come at it from a "next line" perspective. After much reading and experimenting (and debugging) it now works how I wanted it to work. Here it is, in case it can help someone else:

#!/usr/bin/perl
use strict;
use warnings;

my $hn = `/bin/hostname`;
chomp($hn);
my $in = "/MDS/$hn.pcap";
my $out = "/root/$hn.times";
my $cl;
my $nl;
my $pos;
my $ts1;
my $ts2;
my $ts1ms;
my $ts2ms;
my $req;
my $res;
my $td;
my $ms;

open IN, "<", "$in" or die "IN: $!\n";
open OUT, ">", "$out" or die "OUT: $!\n";

while ( $cl = <IN>) {
        next if ( $cl =~ m/^Running as user.*$/ );
        next if ( $cl =~ m/^Capturing on.*$/ );

        $pos = tell(IN);
        if ( $cl =~ m/^.*Who has.*$/ )
        {
                $nl = <IN>;
                if ( $nl =~ m/^.*Who has.*$/ )
                {
                        print "NO ARP RESPONSE FOR: $cl";
                        undef $nl;
                        seek(IN, $pos, 0);
                }
                else
                {
                        ($ts1) = $cl =~ m/^\d+-\d+-\d+\s(.*?)\s\d+:\d+
+:.*$/;
                        undef $nl;
                        seek(IN, $pos, 0);
                }
                next;
        }
        elsif ( $cl =~ m/^.*is at.*$/ )
        {
                ($ts2) = $cl =~ m/^\d+-\d+-\d+\s(.*?)\s\d+:\d+:.*$/;
        }

        ($ts1ms) = $ts1 =~ m/^.*?\.(.*)/;
        ($ts2ms) = $ts2 =~ m/^.*?\.(.*)/;
        $req = `/root/Time $ts1`;
        $res = `/root/Time $ts2`;
        $td = $res-$req;
        $ms = ($ts2ms-$ts1ms)/1000;

        print "ARP Req: $ts1; ARP Res: $ts2; ARP Time: $ms millisecond
+s\n";
        print OUT "ARP Req: $ts1; ARP Res: $ts2; ARP Time: $ms millise
+conds\n";
}

close IN;
close OUT;

[download]

In reply to Re: Previous Line Matching Issues by ImJustAFriend
in thread Previous Line Matching Issues by ImJustAFriend

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.