content: Get Nmap. It doesn't really explain in depth what ports are used for, but it will show open ports and what services those ports are used for. If you were to scan an IP, for example, and discovered that a certain port was open, you could google it, look at what it is used for, and then scan the IP again to find out what kind of device you're looking at. Doing this a few times and coming across the same device with the same open ports helps build an idea of which ones are used for specific things. I believe Nmap also has a "reason" command that will try and find out exactly why the port is open. Of course, you could also check for open ports and then look at common known exploits for those ports. Learning how to take advantage of open ports will also give you an idea as to which ones should be closed.