A lot of discussion I see suggests that changing default ports for services is just "security by obscurity" and is easily defeated by scanning for open ports.
My question is this, though, if the port is changed to a random port, yes an attacker knows it's open, but do they know what service is listening? And if they don't know what service is listening does that make it difficult for them to craft an attack?
Or is it the case that once the port is open, it's then trivial to find out what service is listening on it?
nc localhost 22returnsSSH-2.0-OpenSSH_5.9p1 Debianon my system.nmaphas a rather neat service detection option that can detect all sorts of services and the software and versions running them, even in cases where it isn't quite as obvious as @Zoredache's example.