+ /*
+ * We expect _at least_ two colons in this string. The
+ * possible formats are `sourceport:desthost:destport', or
+ * `sourceip:sourceport:desthost:destport' if you're
+ * specifying a particular loopback address. We need to
+ * replace the one between source and dest with a \t; this
+ * means we must find the second-to-last colon in the
+ * string.
+ */
+ q = qq = strchr(ptr, ':');
+ while (qq) {
+ char *qqq = strchr(qq+1, ':');
+ if (qqq)
+ q = qq;
+ qq = qqq;
+ }
+ if (q) *q = '\t'; /* replace second-last colon with \t */