mdflagwriter using port 21?
The word "Ports" here does not mean what you think it means. It is not the number of a single TCP or UDP port the process has open. It is not even the count of such ports.

'The "ports" column shows how many "Mach ports", or "kernel queues" the process has open, which basically describes how communicative the process can be with others (eg: reserving memory usage from the system). This information will only be useful to system administrators and programmers.'