microoptimization in ipset