Building a small ids-firewall setup

[orphansec]

Hello all :)

I am trying to increase my cyber sec knowledge by creating a small IDS. I was hoping someone could review the code and give me some feed back and maybe point me in the right direction. Currently I am needing intrusion sig's for filters.txt if anyone knows a database of some sort. I also am not too sure where to go next. My current thought is to just check for in/out bin/sh, if bin/sh were to come across the network tap then disconnect and block all future connection attemtps.

Please note that this is basically running Pseudo code.
I am well aware of the pythonic programming, for now I am just trying ideas

Any and all advice would be awesome
Thanks

import pcap,dpkt
import socket
import os
 
def capture():
    dev= pcap.lookupdev()
    for ts, pkt in pcap.pcap(name=dev, snaplen=65535, promisc=True, immediate=False):
        eth = dpkt.ethernet.Ethernet(pkt)
        if eth.type!=2048: #! if ipv6
            ip = eth.data
            typepack = eth.type
            try:
                dst_ip_6= socket.inet_ntop(socket.AF_INET6, ip.dst )  #! Dont judge my huge exception block, it will be fixed after testing
            except AttributeError:
                continue
        else:
            ip = eth.data
            tcp = ip.data
            typepack = eth.type
            try:
                src_ip = socket.inet_ntoa(ip.src)
                dst_ip = socket.inet_ntoa(ip.dst)
                if dst_ip == '192.168.1.2':
                    with open('//usr//home//mrfree//Desktop//Scripts//ipLog.txt','a') as log:
                        log.write('Session:%s:%s,%s\n'%(src_ip,tcp.dport,ts))
                        print('Session:%s:%s,%s\n'%(src_ip,tcp.dport,ts))
                        if tcp.dport < 1028:
                            log.write('Out of bounds connection attempt, Blocking %s \n'%(src_ip))
                            print('Out of bounds connection attempt, Blocking %s \n'%(src_ip))
                    with open('//usr//home//mrfree//Desktop//Scripts//filters.txt','r') as filters:
                        filters = filters.read()
                        if filters in tcp.data:
                                  log.write('Attempted Shell connection, Blocking %s \n'%(src_ip))
                                  subprocess.call('pfctl -k {0}'.format(src_ip))
                                  print('Attempted Shell connection, Blocking %s \n'%(src_ip))
 
            except AttributeError,TypeError:
                continue
 
if __name__ == "__main__":
    capture()