On RTU, the Unit ID is the server address
Serial server addresses normally occupy 1 through 247. Address 0 is reserved for broadcast. A broadcast request is not answered and is suitable only for supported write operations; it cannot be used to discover readable data.
On a gateway, IP and Unit ID select different hops
The host and TCP port reach the gateway. The Unit ID is carried in the MBAP header so the gateway can forward the PDU to a downstream serial server. A successful TCP connection therefore proves only the first hop.
On direct TCP, preserve the configured value
The Modbus TCP implementation guide recommends 0xFF when the Unit Identifier is not significant and notes that 0 is also accepted. Real products vary: some ignore it, some require 1, and some use it to select an internal logical device. Save the working value with the connection profile instead of treating one default as universal.
Detect duplicate addresses on an RTU bus
Two servers configured with the same Unit ID may respond at nearly the same time. The client can see corrupted frames, CRC errors, inconsistent values, or silence depending on driver timing and line conditions. Disconnect segments or power devices selectively until one responder remains, then assign unique addresses before returning the full bus to service.
A clean response does not always exclude a duplicate. One transmitter may consistently dominate or the devices may respond with identical-looking data. Compare identity information and repeat the test while isolating nodes if the topology or commissioning history makes a collision plausible.
Separate gateway reachability from downstream reachability
A TCP socket connects to the gateway, not directly to the serial server. The gateway may accept the connection and still return a gateway exception or timeout for the selected Unit ID. Record the IP address, port, Unit ID, and downstream serial settings as one route; omitting any of them makes the working path impossible to reproduce.
Some gateways reserve Unit IDs for their own management interface or remap downstream addresses. Others use 0, 1, or 255 specially on direct TCP connections. Check the gateway manual before a broad probe and keep successful values per profile rather than promoting one default to a product-wide rule.
Probe Unit IDs with a conservative request
Use a known or likely read that the target class supports and keep the timeout appropriate for the serial route. A valid exception still proves that a server answered at that ID, while no response may mean absence, wrong framing, or an unsupported gateway behavior. Discovery should report these outcomes separately.
Do not use Unit ID 0 for read discovery on RTU. It is the broadcast address and compliant servers do not respond. Broadcast writes also remove response-based verification, so they belong only in an explicit commissioning procedure with known device support and consequences.