Fport is good but I have run into numerous situations where I was gathering volatile data before pulling the plug and had fport return empty results. Some instances were rootkit related while others couldn't be determined. Every time that has happened, though, I've run openports from DiamondCS and it works fine. I also like it's output better because it can add the path of the process listening or look just like fport if you prefer it.
http://www.diamondcs.com.au/openports/I use netstat, fport, openports and tcpvcon in my custom WFT config.
http://www.foolmoon.net/security/wft/-jhs