The short answer is that you need to talk to the port to see who answers. Two things can come from this:
The problem is that banners can be faked, so you need a tool to analyze the traffic in order to get an accurate picture.
- netcat/nc/ncat - useful for basic banner grabbing
- sbd - like nc, but encrypted - useful for basic ssl-based banner grabbing
- nmap - the king of service detection (use -sV)
- wireshark - in-depth protocol analysis with some built-in features (use when using the other tools)
- scapy - for really in-depth raw protocol analysis
- other focused tools for certain protocols like httprint
Metasploit has a long list of service scanners, but they are best to supplement a more direct service analysis. I highly recommend that you shift away from Armitage until you have more experience with the tools above and with the msfconsole. Then, Armitage can improve your productivity.
The more efficient method is to ask the target operating system what it is running. If you can query SNMP, you might get a service and port list handed to you. If you have shell access, you can run commands to list running services.
Be careful that the tools you use don't simply lookup the port number in a table of common services. It is easy to run services on non-standard ports. Also, make sure you scan over the entire 65,535 port range in both TCP and UDP. Some tools, including nmap, improve performance by only checking the most common port numbers, which means they can miss common services running on non-standard ports (ssh on port 8022, for instance). Warning: UDP scans can take a very long time.