Should there be a whitespace match after the port number? How about slightly more specific:
`\s+\S+[.][0-9] 0000[1-9] \S+ <HOST>:[0-9]+ [0-9.]+:[0-9]+ [0-9]+ [0-9]+ [0-9]+ .*$`