how log until the rest of the (legit) network will figure that something is wrong?
Probably within a few hours or so. In about 20 minutes, legitimate miners will start to notice their blocks being orphaned (that's how a 51% attack works, and it's not possible for this to go unnoticed), though it will likely take several more blocks for other causes of orphaned blocks to be ruled out.
what could the "legit network" can do about it?
An alert will be issued, telling users to stop creating and accepting transactions until the attack has ceased. This will cause massive disruption to the Bitcoin economy, though it will be temporary.
is there a formula to calculate hash power / $?
No. All such formulae have no way to account for changes to the price of and demand for mining equipment if an entity attempts to purchase a significant fraction of the available supply.