You can use "netstat -anp" or "netstat -ap" as root to discover what process owns a port. If you used the "n" switch previously, you should use it now. If you didn't, don't. The reason is that the "n" switch also causes it to show port #'s as numbers, instead of looking up in "/etc/services".

Sample output is of the form (Note: there is generally a substantial amount of output):

tcp 0 0 *:smtp *:* LISTEN 7694/sendmail: acce
tcp 0 0 *:113 *:* LISTEN 7663/inetd

We can see that both sockets are currently using tcp. Next we see that they are bound to *, meaning it will listen to any interface, not just one single IP. This is important if, for instance, we have an internal network and an external network (as is common on router, firewall or proxy), and our server should only be listening to a socket on the internal interface.

Next it shows the port in question. In the first example, it's the "smtp" port, which is port 25 as found in "/etc/services". In the second example, it indicates the port as "113", which if we do some looking (as in "/etc/services"), we see is "auth", (also known as identd). With some services, the program looks in "/etc/services" to see what port number it should operate on. Just because it says "telnet" doesn't mean it has to be port 23. Normally, this isn't a problem unless someone's been adjusting "/etc/services".

Now we see "*:*". this is the remote address field. This is stating it is listening for connections from any address and any source port. The connection could come from anywhere essentially and is normal behavior.

Finally we see the owning process, and it's PID. In these cases, it's sendmail and inetd. If we do a "ps aux" we can see more info about these processes, including their owners (root). As a quick note, a service can not bind to a port less than 1024 without being root. To quickly explain the how "httpd" can be on port 80 as "nobody", it starts out as root, and then after binding to port 80, drops is privaliges and switches to "nobody".

References

Most of this comes from a fantastic write up on this subject that could be found at http://archives.neohapsis.com/archives/sf/linux/2000-q3/0692.html but sadly that link has passed away. If you know where it has gone I will be happy to relink it.