Having just received the 'Tumbleweed' badge for this question, I think I will answer it with an alternate configuration in case it helps someone:
$' }
From this starting place, I can grep for different states, different IPs, etc. It's not as good as tcp_monitor and it eats more resources, but it works for my needs.