I've seen scripts that probe ports with nc until they find a free one. They usually log to stdout which port they found.