my ($cap, %dest);

# Open a file and slurp in the entire contents to one scalar
open(CAP, "$file");
    while(<CAP>) { $cap .= $_; }
close CAP;

# Scan through the contents for source/dest pairs and keep track of ho
+w many times the dest gets hit:
while($cap =~ /\s+(?:(?:\d{1,3}\.){3}\d{1,3})\s+->(\d{1,3}\.){3}\d{1,3
+})\s+/g) {
    unless(exists($dest{$1})) { $dest{$1} = 1; }
    else { $dest{$1}++; }
}

# Print out the destinations and the number of times they were hit in 
+descending order
foreach my $dest_addr (sort { $dest{$b} <=> $dest{$a} } keys %dest) 
    { print "$dest_addr\t$dest{$dest_addr}\n"; }
[download]

I realize that the actual execution times from run to run will be different based on how much activity is on the server at the time, but I really can't explain how parsing exactly the same file with exactly the same code can result in such drastically different execution times.

The remaining code surrounding this block is solid, I've done numerous Benchmark::Timer tests to granularly check each piece of my code, and literally, this is the only place where I get a jump in execution time, and it's only seen sometimes, but as far as I can tell, NOTHING is changing from run to run.

Based on what I've got above, can anyone see where I may be going wrong? Are there glaringly obvious Perl traps that I'm missing? This one really has me stumped....