One way to do it is to use nmap on your Linux machine to scan your QNX embedded device and see what open ports it reports.
However by default no ports are open on QNX. Ports are only opened based on the services you start (ftp, telnet, qconn etc) in QNX. If you start no services, no ports are open.
The ones marked ‘Listen’ are listening for incoming connections. ‘Established’ are currently connected sockets and the ones with no state have simply been reserved by the process but aren’t actively connected to any remote machine nor are they listening.