ssh -L1234:host:5900 foo.bar.org
this will port map your (-L means local) port 1234 to host's port 5900 . 5900 is vnc for the first display. vnc on linux with X running goes to the second display though so 5901.
so if i need to vnc to the server where administrator is always left on and i'm at home i use:
ssh -L5900:ghost:5900 rook -p554
-L5900 let's me just type vncviewer localhost without a port
ghost is the server i need
it's a windows box so it's the first display
rook is the ssh host
port 554 is used because 22 is blocked.
now just hope my system admin doesn't read this and say "gar why is he vnc'ing to my server from home!"
let me know if you have any troubles.