Daemons and services.
A daemon (pronounced demon, NOT daymon) is a program invoked by a connection to a port at a certain address. On a network, daemons are located by an address:port specification. Typically localhost:25 is a good place to look if you wish to send mail on an internet enabled machine. Port 25 is the standard port number for the sendmail daemon.
Daemons can run in a number of ways. They can run continuously and when a client connects, they fork a copy of themselves to deal exclusively with this client. They can run continuously and, instead of forking, they will multiplex multiple connections. This is useful for controlling a large number of connections from one process. Finally they can be invoked from the master daemon, inetd.
Inetd listens on all the ports specified in its configuration file/etc/inetd.conf.
When a connection is made on any of them, it launches a copy of the relevant service and passes the connection onto them as stdin & stdout.
Which way a daemon is run is quickly identified by looking in/etc/inetd.conf. If it is missing, ps (-ef for SVR4, -aux for BSD) and scanning the displayed list of processes for the one of interest identifies a continuously running daemon.
Daemons typically use a service called syslog for normal diagnostics. The location of the generated log files is usually /var/adm or /var/log.
Daemons providing a service can be referred to by a service name. These are defined in /etc/services. Typically an application requiring a FTP connection will do a getservbyname( ) for 'ftp.' It will use that number when contacting the remote machine.