For example, I run nmap and find that port 712 is open:
712/tcp open unknown
But it's easily identified:
# fuser 712/tcp 712/tcp: 2098 # ps -fp 2098 UID PID PPID C STIME TTY TIME CMD root 22098 8999 0 Aug18 ? 22:33 /usr/etc/customd # man -k customd custom (1M) - Custom daemon