Let's say you want to be able to SSH into your server from anywhere. But you find that if you leave SSH listening on port 22, systems all over the Internet are regularly trying to log into it and filling up your logs with auth failures. You are offended by this.
So you set up port knocking.
Your firewall blocks access to port 22 - but if packets come for ports 1234 and 5678 in the space of one minute, your firewall will open access to port 22 for a brief window. Therefore, your SSH server is safe from random people (who won't know how to "knock" to open the port) but you can get in whenever you want by sending a couple of special packets before connecting.
In this scenario, ports 1234 and 5678 aren't listening, there's no service running there - the special bit is that the firewall notices attempts to reach those ports and does something accordingly.
As security goes, this is minor; it's a form of security through obscurity, and only offers incremental benefits. It can be useful in cutting down noise from automated attackers, though.