este post me ayudo con mi proyecto, cambie el codigo para que en vez de escribir, lograra leer un registro en el plc, pero me manda 16 bit de error, me ayudan a saber cual es el problema...
Saludos

 public void Sockettwo()
 {
     string SERV_IP_ADDR = "192.168.1.90";
     const int FINS_UDP_PORT = 9600;

     byte[] sendPacket = new byte[]
     {
 // Full UDP packet: 80 00 02 00 00 00 00 05 00 19 01 02 82 00 64 00 00 01 00 01
 // Header
 0x80, //0.(ICF) Display frame information: 1000 0001
 0x00, //1.(RSV) Reserved by system: (hex)00
 0x02, //2.(GCT) Permissible number of gateways: (hex)02
 0x00, //3.(DNA) Destination network address: (hex)00, local network
 0x00, //4.(DA1) Destination node address: (hex)00, local PLC unit
 0x00, //5.(DA2) Destination unit address: (hex)00, PLC
 0x00, //6.(SNA) Source network address: (hex)00, local network
 0x05, //7.(SA1) Source node address: (hex)05, PC's IP is 192.168.250.5
 0x00, //8.(SA2) Source unit address: (hex)00, PC only has one ethernet
 0x19, //9.(SID) Service ID: just give a random number 19

 // Command (Updated for Read Request)
 0x01, //10.(MRC) Main request code: 01, memory area read (0x01: Read, 0x02: Write)
 0x01, //11.(SRC) Sub-request code: 01, memory area read

 // PLC Memory Area
 0x82, //12.Memory area code (1 byte): 82(DM)

 // Address information
 0x00, //13.Read start address (2 bytes): D100
 0x64,
 0x00, //15.Bit address (1 byte): Default 0
 0x00, //16.No. of items (2 bytes): Read 1 word (D100)
 0x01,

         // No data to send, just requesting to read
     };

     UdpClient client = new UdpClient(); //create a UdpClient instance

     try
     {
         // Send the request packet to read from the PLC
         client.Send(sendPacket, sendPacket.Length, SERV_IP_ADDR, FINS_UDP_PORT);

         // Receive the response (response packet will contain the read value)
         IPEndPoint remoteEndPoint = new IPEndPoint(IPAddress.Parse(SERV_IP_ADDR), FINS_UDP_PORT);
         byte[] receivePacket = client.Receive(ref remoteEndPoint);

         // Print the received packet length and content for debugging
         Console.WriteLine("Received packet length: " + receivePacket.Length);
         Console.WriteLine("Received packet: " + BitConverter.ToString(receivePacket));

         // Ensure packet is at least 19 bytes long
         if (receivePacket.Length >= 19)
         {
             // Debugging: Print the part of the packet where data is expected
             Console.WriteLine("Extracted data (from byte 17 onward): " + BitConverter.ToString(receivePacket, 17, receivePacket.Length - 17));

             // Extract the read value from the response packet (data starts at byte 17)
             byte[] readData = new byte[2];  // Adjusted to read 2 bytes for int16 (for 'D100' which is INT)
             Array.Copy(receivePacket, 17, readData, 0, 2);  // Copy 2 bytes (for 'int16')

             // Convert the read data to a 16-bit integer (for an 'int16' type, 2 bytes)
             short value = BitConverter.ToInt16(readData, 0);  // Using ToInt16 for 2 bytes
             Console.WriteLine($"Read value: {value}");
         }
         else
         {
             Console.WriteLine("Received packet is too short to contain the expected data.");
         }
     }
     catch (SocketException se)
     {
         Console.WriteLine(se.ErrorCode + ": " + se.Message);
     }

     client.Close();
 }