To see which daemons are listening for connection requests use sockstat -4l for IPv4, and sockstat -l for IPv4 and IPv6.
% sockstat -4l USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS www httpd 292 16 tcp4 *:80 *:* www httpd 173 16 tcp4 *:80 *:* root httpd 154 16 tcp4 *:80 *:* root sendmail 104 3 tcp4 *:25 *:* root sendmail 104 6 tcp4 *:587 *:* root sshd 99 4 tcp4 *:22 *:* root inetd 92 4 tcp4 *:21 *:* root inetd 92 5 tcp4 *:23 *:* root inetd 92 6 tcp4 *:119 *:* root inetd 92 7 udp4 *:518 *:* root inetd 92 8 tcp4 *:113 *:* root named 86 4 udp4 *:3616 *:* root named 86 20 udp4 172.16.0.1:53 *:* root named 86 21 tcp4 172.16.0.1:53 *:* root named 86 22 udp4 192.168.0.50:53 *:* root named 86 23 tcp4 192.168.0.50:53 *:* root named 86 24 udp4 127.0.0.1:53 *:* root named 86 25 tcp4 127.0.0.1:53 *:* root named 86 26 udp4 69.69.238.89:53 *:* root named 86 27 tcp4 69.69.238.89:53 *:* root syslogd 83 5 udp4 *:514 *:*
To see who is connecting to your box, use sockstat -c. This example is for IPv4 and xchat:
% sockstat -c4l rpratt xchat 98613 8 tcp4 69.69.238.89:3263 216.74.66.208:6667 rpratt xchat 98613 9 tcp4 69.69.238.89:3891 68.35.154.159:1024
The first line represents the connection to the IRC server on port 6667. The second line is a user who is connected to a fileserver in xchat. Most IRC servers try to hide that information from other users but it is easily found if you suspect someone of abuse.