Blacklisting methodology

Hey guys.  I'm working on banning people from JLCP via the admin console 
and I was wondering if anyone had a nice way of blocking IPs.  We can 
get the IP from the request as it comes in and check in our database to 
see if its blocked.  My question is how far up do we want to block.  If 
someone's IP is 216.27.54.20, just blocking that exact address won't 
work for a dynamic range.  Do we need to block all the way up to 
216.27.*.*? or just 216.27.54.*.  Your thoughts?  We are also blocking 
by username, but this doesn't do a whole lot of good since someone could 
just create another user with a different username.

-Matt