Running services on a host machine typically open a port in the operating system and start listening to it in order to accept incoming TCP communication and start the three-way handshake. In Nmap, you can send an SYN packet on a specific port and, if the host responds with SYN-ACK, then the service is running and listening to the port.
Let's test the HTTP port, for example in google.com, using nmap:
nmap -p 80 www.google.com
We can use the same concept to discover the running services on the router. For example, the router that runs the BGP daemon will listen to port 179 for open/update/keep alive/notification messages. ...
