Discover Services Running on Target

Once an attacker detect open ports, he will attempt to discover the nature of the services running on the ports. This give him indication of any vulnerability that can be exploited to gain access to the target. Also an attacker will try to discover details of the operating system running on the target. The category of tools used for this are port scanners. While IDS or firewall can check port scanning to a great extent - if properly configured.
The popular type of firewall deployment are the application proxies and the packet filtering gateways. The possible vulnerability in any firewall is mis-configuration.
Scanning and banner grabbing allow attacker to take advantage of this identification. They may even be able to identify the version, type and maybe even certain rules.
To understand port scanning better, it is essential to understand how TCP connection is established between two systems as most scanners take advantage of this "three-way handshake".

1. SYN sent from Client
2. SYN/ACK sent from Server
3. ACK sent from Client

Once the three-way handshake has been completed, there is bi-directional communication over the connection. TCP supports packet re-ordering, repeat transmission of lost packet, acknowledges packet arrival and flow control, which is important for message based application.
The three-way handshake synchronize the connection and use sequence and acknowledgment number to indicate data transmission and reception. The TCP flag control the flow of the session and it is technically what a part scanner take advantage of. These flag can be used to collect port information.
Port numbers unlike IP numbers are not unique - though, they are unique to the system. They form the communication end points between systems. While the client use arbitrarily assigned port numbers, the server uses fixed port numbers to facilitate communication. Readers are encouraged to read RFC 1700 to familiarize themselves with assigned port number. In UNIX, there is file /etc/services and on Windows, there is file %windir%\system32\drivers\etc\services show the mapping of service to the assigned port number. An attacker getting access to this file to get entire communication mapping of the system.