Which application is using that port?

See which ports are open, as an attacker would:

nmap 127.0.0.1

(Superuser seems to need to be used on some the following commands)

See which process is using port 25:

netstat -nlp | grep 25

Same, with a bit less info:

fuser -n tcp 25

Or you could also do:

fuser -u smtp/tcp

Discovered here