Please note, I'm looking more for established documented best-practice rather than personal opinion in this question. I'm also not interested in Fail2Ban specifically but the class of technologies that Fail2Ban is a member of.
Fail2Ban et al track misbehavior by IP addresses, such as repeatedly attempting to log-in with passwords from a dictionary until one succeeds. Once a single IP has hit a limit, all attempts from that IP are rejected, even if they guess the correct password in that time.
What should happen to the IP neighbors of that banned IP address? Someone attacking my servers might be trivially able to move to a neighboring IP by resetting their ISP router every so often. Do attackers actually do this is the real world?
If I've caught a.b.c.d failing to log-in too many times, should I also ban all of a.b.c.0/24? How many bits is a reasonable boundary?
What about IPv6? I know that /64 is the rough equivalent of a single IPv4, but where is the equivalent block size for an IPv6 neighborhood?
Is there an established best practice document I can refer to that answers these questions?