Portscan parameters

["shadi Rostami" <shadi () inkra com>]

I was just wondering, what are the typical values for portscan threshold and
period.
In snort.conf, it seems to be 4 ports in 3 seconds.
Are these realistic numbers? Don't you get many false alarms if you set
these numbers? I myself was thinking of portscan as about 50 scans within a
second!

Thanks a lot
--Shadi