80 is http, 25 is mail, 6667 is normally IRC, 8080 often proxy, & blah blah... But its really the programs that use 'em that you need to worry about. As for ports each of them can be used for very little or a large number of things... deppending on which one though. You could however find 6667 and say, hey that looks like one of my users is into IRC... due to the fact that its a common port for services like that, but just by seeing that its open doesn't actually mean thats what is actually going on though... Hell you can do alot of stuff VIA: (some randomly chosen port).