Ah. I’ll bet it’s ‘2’ for DLR mode, and ports ‘3’ and ‘4’ in Dual-IP mode. These sorts of things can be interrogated with custom messages if one has the device in hand…
One can also construct outbound message instructions in an offline project and inspect the path bytes left in the MESSAGE tag.