You are right, Dynamic Discovery has initiator send 'SendTargets' request to a single IP address/port and if the target listens on multiple names and addresses, all of them are sent in a form of TargetName and TargetAddress (IP:port#). I believe determining what LUNs are behind the target is not a part of Dynamic Discovery

As for your second question, server hardware is probably more flexible in terms of NICs that can be used, therefore software-based ISCSI is more flexible as well, allowing setting up multiple IPs. Multiple IP/port combinations ont the target gives many more options: one being the ability to connect to the storage from different networks (although that can also be accomplished on routed networks ), second being more paths in multipathing configuration when the same LUNs can be accessed using two different IP addresses. And lastly, so that IP hash policy could be used for better load distribution between pNICS in NIC teaming configuration on the ESX host.