Can you improve apon this go script?

specifically, i mean add a something that closes the connection after it has blocked the IP address so that it is not a hanging socket, has the capability to read more than syn ack fin rst, it should be able to do all types of packets. it should also just b overall more efficient.

this needs to be literally as efficient as possible.

```
package main

import (
	"bufio"
	"fmt"
	"log"
	"net"
	"os/exec"
	"strings"
	"sync"
	"sync/atomic"
	"time"

	"github.com/google/gopacket"
	"github.com/google/gopacket/layers"
	"github.com/google/gopacket/pcap"
)

const (
	PACKET_THRESHOLD = 50
	SYN_THRESHOLD    = 10
	RST_THRESHOLD    = 5
	ACK_THRESHOLD    = 50
	FIN_THRESHOLD    = 10 
	TIME_WINDOW      = 5 * time.Second

	IPSET_MAX_ELEM = 1000000

	IPSET_RESET_THRESHOLD = IPSET_MAX_ELEM
)

var (
	whitelist = map[string]struct{}{
		"185.17.0.79": {},
		"204.152.216.119": {},
	}
	packetCounts sync.Map
	blockedIPs   sync.Map

	resetCountsChan = make(chan struct{})
)

func isWhitelisted(ip net.IP) bool {
	_, ok := whitelist[ip.String()]
	return ok
}

func createMatchSet() {
	cmd := exec.Command("ipset", "create", "blocked_ips", "hash:ip", "maxelem", fmt.Sprintf("%d", IPSET_MAX_ELEM), "-exist")
	output, err := cmd.CombinedOutput()
	if err != nil {
		log.Println("Error creating ipset:", err)
		log.Println(string(output))
	}
}

func flushMatchSet() {
	cmd := exec.Command("ipset", "flush", "blocked_ips")
	output, err := cmd.CombinedOutput()
	if err != nil {
		log.Println("Error flushing ipset:", err)
		log.Println(string(output))
	} else {
		fmt.Println("Flushed ipset 'blocked_ips'")
	}
	blockedIPs = sync.Map{}
}

func addIPToMatchSet(ip string) {
	if _, loaded := blockedIPs.LoadOrStore(ip, struct{}{}); loaded {
		return
	}
	count, err := getIPSetCount("blocked_ips")
	if err != nil {
		log.Println("Error getting ipset count:", err)
	} else if count >= IPSET_RESET_THRESHOLD {
		flushMatchSet()
	}

	cmd := exec.Command("ipset", "add", "blocked_ips", ip, "-exist")
	output, err := cmd.CombinedOutput()
	if err != nil {
		if strings.Contains(string(output), "full") || strings.Contains(string(output), "cannot add to the set") {
			log.Println("Ipset is full, flushing and recreating the set.")
			flushMatchSet()
			cmd = exec.Command("ipset", "add", "blocked_ips", ip, "-exist")
			output, err = cmd.CombinedOutput()
			if err != nil {
				log.Println("Error adding IP to ipset after flush:", err)
				log.Println(string(output))
				return
			}
		} else {
			log.Println("Error adding IP to ipset:", err)
			log.Println(string(output))
			return
		}
	}
	fmt.Printf("Blocked IP address: %s\n", ip)
}

func blockMatchSet() {
	cmd := exec.Command("iptables", "-C", "INPUT", "-m", "set", "--match-set", "blocked_ips", "src", "-j", "DROP")
	err := cmd.Run()
	if err != nil {
		cmd = exec.Command("iptables", "-I", "INPUT", "-m", "set", "--match-set", "blocked_ips", "src", "-j", "DROP")
		output, err := cmd.CombinedOutput()
		if err != nil {
			log.Println("Error updating iptables:", err)
			log.Println(string(output))
		}
	}
}

func resetPacketCounts() {
	ticker := time.NewTicker(TIME_WINDOW)
	defer ticker.Stop()
	for {
		select {
		case <-ticker.C:
			packetCounts = sync.Map{}
		case <-resetCountsChan:
			return
		}
	}
}

func main() {
	handle, err := pcap.OpenLive("ens3", 1600, true, pcap.BlockForever)
	if err != nil {
		log.Fatal("Error opening device: ", err)
	}
	defer handle.Close()
	if err := handle.SetBPFFilter("tcp"); err != nil {
		log.Fatal("Error setting BPF filter: ", err)
	}

	createMatchSet()
	blockMatchSet()
	go resetPacketCounts()
	packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
	packetChan := make(chan gopacket.Packet, 1000)
	var wg sync.WaitGroup
	numWorkers := 4 // GOOD SERVER = GOOD
	for i := 0; i < numWorkers; i++ {
		wg.Add(1)
		go packetWorker(packetChan, &wg)
	}
	for packet := range packetSource.Packets() {
		packetChan <- packet
	}
	close(packetChan)
	wg.Wait()
	close(resetCountsChan)
}

func packetWorker(packetChan <-chan gopacket.Packet, wg *sync.WaitGroup) {
	defer wg.Done()
	for packet := range packetChan {
		processPacket(packet)
	}
}

func processPacket(packet gopacket.Packet) {
	ipLayer := packet.Layer(layers.LayerTypeIPv4)
	if ipLayer == nil {
		return
	}
	ipAddr := ipLayer.(*layers.IPv4).SrcIP
	if isWhitelisted(ipAddr) {
		return
	}
	updateCount(ipAddr.String(), "", PACKET_THRESHOLD)

	tcpLayer := packet.Layer(layers.LayerTypeTCP)
	if tcpLayer != nil {
		tcpPacket := tcpLayer.(*layers.TCP)
		if tcpPacket.SYN {
			updateCount(ipAddr.String(), "-SYN", SYN_THRESHOLD)
		}
		if tcpPacket.RST {
			updateCount(ipAddr.String(), "-RST", RST_THRESHOLD)
		}
		if tcpPacket.ACK {
			updateCount(ipAddr.String(), "-ACK", ACK_THRESHOLD)
		}
		if tcpPacket.FIN {
			updateCount(ipAddr.String(), "-FIN", FIN_THRESHOLD)
		}
	}
}

func updateCount(ip, suffix string, threshold int32) {
	key := ip + suffix
	var newCount int32 = 1
	actual, loaded := packetCounts.LoadOrStore(key, &newCount)

	if loaded {
		countPtr := actual.(*int32)
		newVal := atomic.AddInt32(countPtr, 1)
		if newVal > threshold {
			addIPToMatchSet(ip)
			packetCounts.Delete(key)
		}
	} else {
		if newCount > threshold {
			addIPToMatchSet(ip)
			packetCounts.Delete(key)
		}
	}
}

func getIPSetCount(setName string) (int, error) {
	cmd := exec.Command("ipset", "list", setName)
	output, err := cmd.Output()
	if err != nil {
		return 0, err
	}

	scanner := bufio.NewScanner(strings.NewReader(string(output)))
	for scanner.Scan() {
		line := scanner.Text()
		if strings.HasPrefix(line, "Number of entries:") {
			parts := strings.Fields(line)
			if len(parts) >= 4 {
				count := parts[3]
				var num int
				fmt.Sscanf(count, "%d", &num)
				return num, nil
			}
		}
	}
	if err := scanner.Err(); err != nil {
		return 0, err
	}

	return 0, fmt.Errorf("Could not find ipset count")
}
```