Telnet is essentially just opening a raw TCP socket. Hence any port that accepts TCP connections will allow you to connect to it with telnet (sometimes briefly, if you don't subsequently negotiate correctly and in a timely manner).
That includes the SSH service that runs by default on port 22 by the way, but since that is not a plain text protocol (like the telnet service on port 23 or SMTP on port 25) you can't manually type characters into the socket after you connect and expect it to work - it will just be garbled nonsense.
In terms of knowing which ports to try on a given server, first off you need to be careful - scanning for open ports on a machine that you do not own can get you into trouble with the owner of that machine, and it can set off alarms on intrusion detection systems. It is, after all, how a hacker would attempt to "footprint" a host to determine what is running on it. There is no easy way to distinguish between that type of scan and your relatively innocent one, so be careful.
If you own the machine or are sure that there is no problem with you looking for open ports on it, then you can use a program like nmap (there are others) to figure out what you can connect to.
In terms of knowing what ports to connect to in advance, or figuring out what a particular open port might do, the official registry of port assignments is the first port of call. You will usually have a version of this locally on your host also - for Unix/Linux systems you can find this in /etc/services
and for Windows it will be something like C:\Windows\System32\drivers\etc\services
. Be warned that those local copies can often be quite stale.
It is also worth noting, that you can run services on whatever port you want, these are just the registered defaults. Some services don't register at all. In other cases an administrator may run a service on a non-standard port simply to avoid obvious port scans (running ssh on port 722 for example). You can in theory run a web server on port 22 and then point your browser at http://server:22/
and it will work, but why would you want to? (besides perhaps circumventing a firewall).
Which makes HTTP worth mentioning - you can telnet to port 80 (the http default port) and issue a simple command in plain text, just like a browser. It used to be as easy as sending GET /
but that was in the HTTP 1.0 days, and it's a little (but not much) more complicated now:
$ telnet superuser.com 80
Trying 198.252.206.16...
Connected to superuser.com.
Escape character is '^]'.
GET / HTTP/1.1
Host: superuser.com
HTTP/1.1 200 OK
Cache-Control: public, no-cache="Set-Cookie", max-age=14
Content-Type: text/html; charset=utf-8
Expires: Thu, 31 Jul 2014 18:04:39 GMT
Last-Modified: Thu, 31 Jul 2014 18:03:39 GMT
Vary: *
X-Frame-Options: SAMEORIGIN
Set-Cookie: prov=d901880d-730c-4d91-9ac9-7d81d84fe58a; domain=.superuser.com; expires=Fri, 01-Jan-2055 00:00:00 GMT; path=/; HttpOnly
Date: Thu, 31 Jul 2014 18:04:24 GMT
Content-Length: 69500
<!DOCTYPE html>
I've truncated the rest for the sake of brevity.
2Well if you're connecting to an SMTP server you'd connect to port 25. If you're connecting to a Telnet server then you'd connect to port 23. If you're connecting to an SSH server then you'd connect to port 22. So yes, the port is different depending on what type of server/service you're connecting to. – joeqwerty – 2014-07-31T16:31:36.417