ENH: more on ipset