ipset:enum()
look for authreq in connecting clients too
ban hooks