BTW. You should probably be using exists in your conditions to prevent autovivifying keys that you don't use:

if( exists $total{"$source$dport"}{'from'} ) {
[download]

Without the exists, you will autovivify a key ("$source$dport") in %total that will have an anonymous hash assigned to it.

print exists $h{a} ? 1 : 0;;
0

print $h{a}{b} ? 1 : 0;;
0

print exists $h{a} ? 1 : 0;;
1

print $h{a};;
HASH(0x18eee74)
[download]

I don't think it will make much if any difference to your memory consumption in this case as you will go on to assign to the key anyway, but getting into the habit of using exists is a good thing in the long run as even empty anonymous hashes consume a fair amount of space.