ipset updates now happen in bulk