It's been a while, but back when I did full-time sysadmin, I used a port-knocking daemon that picked a random port > 1024 (with carve-outs for some known ports)

It's been a while, but back when I did full-time sysadmin, I used a port-knocking daemon that picked a random port > 1024 (with carve-outs for some known ports) and sent that port # to my pager. As you suggest, though, the port-knocking daemon itself ran on port 2222.