Reverse shells

How can you detect the presence of a reverse shell, aside from using network monitoring like Wireshark or something? Can you just use the w or who commands to see all shells? And how can you disallow reverse bash shells? Maybe make it so commands with bash and /dev/tcp/ aren't allowed?

She reverses reversed shells by the reversed shore.