[CentOS] what percent of time are there unpatched exploits against default config?

> Does ipset work with the existing kernel under CentOS 5 and if so is there an RPM available?
> I've goggled around a bit, but haven't found anything.  From http://ipset.netfilter.org/ I'm led 
> to believe that the current kernel should support it.

Well, you have modules on your system, and if you Google you'll see a couple repos have the
userland tools. Check out CentALT for example...