Yes TCP port 23 is Telnet, hence why I said 'I assume you mean TCP' as it could also be UDP or any other IP Protocol....
This is an extended IP access list, you have the options of specifying either the source and destination IP addresses or the source and destination IP addresses and the source and destination layer-4 port numbers. You can also specify things like DSCP or IP Precedence values etc.
The logic is as follows:
access-list 101 - this is the ACL number, 1-99 are standard IP ACLs and you can only specify the source IP address, 100-199 are extended IP ACLs and allow you to specify source & destination IP addresses as well as layer-4 information
deny - you want to block access so you must use the keyword deny
tcp - the layer-4 protocol you want to deny is a TCP based one (telnet)
any - this is the source IP address; any literally means that - any. You can optionally add a layer-4 port number here, this would be the source port number, with none specified it means any port number
any - this is the destination I address, you could set this to be a host or a subnet, it depends on your requirements
eq 23 - this is the destination port number
Normally you would have much more listed in an ACL, especially an internet facing router such as:
access-list 101 deny ip 10.0.0.0 0.255.255.255 any
access-list 101 deny ip 172.16.0.0 0.15.255.255 any
access-list 101 deny ip 192.168.0.0 0.0.255.255 any
access-list 101 deny ip 169.254.0.0 0.0.255.255 any
access-list 101 deny udp any any range 135 139
access-list 101 deny tcp any any range 135 139
access-list 101 deny tcp any any eq 23
access-list 101 deny tcp any any eq 445
access-list 101 deny tcp any any range 0 1
access-list 101 deny tcp any any eq 389
access-list 101 deny tcp any any eq 1080
Andy