DDOS perl script - perl

Question

Im trying to write a script that uses tcpdump under openbsd than monitor firewall logs.
My goal is to genereate an alert if a source ip address is equal to evry line [ line duplicate ] from the tcpdump output, example :
rule 30/0(match): block in on pppoe0: SRCIP:(88.198.46.51) -> DESTIP:(109.226.27.19): ICMP echo request, id 1070, seq 1, length 64
rule 30/0(match): block in on pppoe0: SRCIP:(88.198.46.51) -> DESTIP:(109.226.27.19): ICMP echo request, id 1070, seq 2, length 64
rule 30/0(match): block in on pppoe0: SRCIP:(88.198.46.51) -> DESTIP:(109.226.27.19): ICMP echo request, id 1070, seq 3, length 64
rule 30/0(match): block in on pppoe0: SRCIP:(88.198.46.51) -> DESTIP:(109.226.27.19): ICMP echo request, id 1070, seq 4, length 64
rule 30/0(match): block in on pppoe0: SRCIP:(88.198.46.51) -> DESTIP:(109.226.27.19): ICMP echo request, id 1070, seq 5, length 64
rule 30/0(match): block in on pppoe0: SRCIP:(88.198.46.51) -> DESTIP:(109.226.27.19): ICMP echo request, id 1070, seq 6, length 64
rule 30/0(match): block in on pppoe0: SRCIP:(88.198.46.51) -> DESTIP:(109.226.27.19): ICMP echo request, id 1070, seq 7, length 64
rule 30/0(match): block in on pppoe0: SRCIP:(88.198.46.51) -> DESTIP:(109.226.27.19): ICMP echo request, id 1070, seq 8, length 64
ip 88.198.46.51 is attempted dos attack.
my code so far:
open(SNIFF, "/usr/sbin/tcpdump -s 1024 -enlti pflog0 |");
while(<SNIFF>){
$|++;
$_ =~ /(\d+.\d+.\d+.\d+)(.)(\d{2,5}) (>) (\d+\.\d+\.\d+\.\d+)(.)(\d{2,5})/;
my ($sip, $port) = ($1, $7);
my $bad_ip = $sip;
if($bad_ip eq $p_ip){
$count++;
if($count >= 8 && $print){
print "Attack Detected: $sip\n";
system("echo $sip");
#system("/sbin/pfctl -f /etc/pf.conf");
$print = 0;
}

Answer 1

In your sample input, I don't see a single line that matches the first part of your regex:
/(\d+\.\d+\.\d+\.\d+)(\.)(\d{2,5})/
(Note, that I anticipated that if you're looking for a dotted decimal, that you really want \d+\. not just \d+..)
You can match (\d+\.\d+\.\d+\.\d+) with your input, but the rest is not going to match. That's your issue.