The solution lies in the following: You can never have more than one connection to one port. The sniffer has left some parts out, because the connections are not really to the :80 port, but dispatched to another, higher number. However, the from port is such a high number, so we can assume that's the real (dispatched) port.

Take your example: 

*snip* from=(111.111.111.111:1234) to=(22.22.22.22:80)
*snip* ASCII ... from=(111.111.111.111:1234), localport=(80), *data he
+re*
*snip* from=(111.111.111.111:1234) to=(my.box.ip.addr:80)
*snip* ASCII ... from=(111.111.111.111:1234), localport=(80), *data he
+re*

[download]
Because there can only be one connection from the :1234 port, the connection to 22.22.22.22:80 must be broken before the connection to my.box.ip.addr:80 has been made. On basis of that you get: 
$_ = <INPUT>;
m/.*?\(([\d\.\:]*)\).*?\(([\d\.\:]*)\)(.*)/;
( $2 =~ m/:/ ) && ( $mine{$1} = ($2 eq $mybox) ) ;
( $2 =~ m/^\d+$/ ) && $mine{$1} && print $3;

[download]
Hope this helps,

Jeroen
I was dreaming of guitarnotes that would irritate an executive kind of guy (FZ)

Update: chipmunk pointed to some typos. Thanx! Furthermore, I rewrote line 3, it's cleaner now.

In reply to Re: Algorithmic difficulties by jeroenes
in thread Algorithmic difficulties by Guildenstern

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.