A port is "active" because a daemon (service) application program is running on the system has successfully opened it and is now waiting for packets to arrive. There are, basically,
two ways that this can come about...
(1) The service was started during the startup of your computer. Technically, this occurred because
/etc/rc.d/rc5.d contains a symbolic-link with a name beginning with the letter "S" ...
... that points to an entry in
/etc/init.d ...
... which is a command-file that will start this program.
(2) The service is started by
xinetd whenever someone tries to open this port, because there's an entry in
/etc/xinet.d which specifies this port. (
xinetd listens on a number of ports
in case someone requests it, and starts the appropriate program for that port if anyone actually answers).
Armed with this "clear as mud" ...
... information, you should actually be able to resolve this question. Go to the files in the directories I've mentioned, and "look around." The little-light will come on.
