Does normal network traffic sent out by software or anything else use port scanning for legitimate reasons?
I'm using psad on my linux server and am unsure if setting the auto-ban IP feature on danger level 1, which equals to 5 sent packets, would accidentaly ban justified traffic and therefor users.