I wanted to learn more about how Intrusion Detection worked so I searched for "How to write IDS in bash".
I found that netstat -an | grep LISTEN | grep <port number> would find ports in use by testing on the returned response ($?). But this also returns about a dozen of lines like:
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ACC ] STREAM LISTENING 6220 /tmp/ssh-qUrvMutm1987/agent.1987

But the I-node numeric sequence is irregular which puzzles me??
Is an I-node not a port number?? Confused!
If ACC means waiting for a connection does that also imply the port is in service and waiting for a specific external input??
Perhaps someone can clarify for me please and thanks.

You should read the netstat man page. There are many protocols that could be used.
In normal usage, its usually either tcp or udp or unix sockets.

http://linux.die.net/man/8/netstat

Thanx 4 the url. I had blindly used the netstat line as it had been presented. Even in my man page the distinction of Connect, Waiting for, and Disconnect was not as obvious. Sometimes the man page is far too specific and lacks sufficient explanation unless one is totally awash with the subject.

I still don't understand why the I-nodes are not numerically sequenced?
Regarding the protocols; I would think that is not useful here since I want the state of the port and a port cannot as far as I know be connected in multiple protocols simultaneously only sequentially if that.
In fact I am not sure why I am getting this dozen or so since the last grep specifies a particular port which is not any of the I-nodes shown tho it was not necessary to list all of them. Thanks tho 4 the url again