Help me CIP read data fail from control LGX (1756-enbt))

hello:
I want to read data with CIP MSG without RSLinx.
My program flow is pensession->register session->connection(forward open),then i proceed the read data function(4c),but no response.the read data packetis following(read a int data ,tag 'a').

And the response packet has some "02 04 05 b4 c0 a8"but i done't know the meaning.
Can anyone help me .It's so urgent,but i have no way.Thanks a lot.

EtherNet/IP (Industrial Protocol), Session: 0x13020200, Send Unit Data
Encapsulation Header
Command: Send Unit Data (0x0070)
Length: 30
Session Handle: 0x13020200
Status: Success (0x00000000)
Sender Context: 0000000000000000
Options: 0x00000000
Command Specific Data
Interface Handle: CIP (0x00000000)
Timeout: 1
Item Count: 2
Type ID: Connected Address Item (0x00a1)
Length: 4
Connection Identifier: 0x56780029
Type ID: Connected Data Item (0x00b1)
Length: 10
Sequence Count: 0x0002
Common Industrial Protocol
Service: Open Connection (Request)
0... .... = Request/Response: Request (0x00)
.100 1100 = Service: Open Connection (0x4c)
Request Path Size: 2 (words)
Request Path: a
Extended Symbol Segment (0x91)
Data Size: 1
Data: a
Pad Byte (0x00)
Command Specific Data
Data: 0100


the response:
Frame 4 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: Rockwell_3f:81:0e (00:00:bc:3f:81:0e), Dst: Giga-Byt_ca:bc:52 (00:14:85:ca:bc:52)
Destination: Giga-Byt_ca:bc:52 (00:14:85:ca:bc:52)
Source: Rockwell_3f:81:0e (00:00:bc:3f:81:0e)
Type: IP (0x0800)
Trailer: 020405B4C0A8
Internet Protocol, Src: 192.168.0.251 (192.168.0.251), Dst: 192.168.0.249 (192.168.0.249)
Transmission Control Protocol, Src Port: EtherNet/IP-2 (44818), Dst Port: 4207 (4207), Seq: 2, Ack: 55, Len: 0
Source port: EtherNet/IP-2 (44818)
Destination port: 4207 (4207)
Sequence number: 2 (relative sequence number)
Acknowledgement number: 55 (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
Window size: 4066
Checksum: 0x62b1 [correct]
[SEQ/ACK analysis]
[This is an ACK to the segment in frame: 3]
[The RTT to ACK the segment was: 0.000878000 seconds]

I have done something similar years ago to write a limited driver. I used a program called Spy Debug (it was for a Siemens TS adaptor). The trick is to use RSLinx first and observe comms with a Spy Debug (resets, reinitiates, timeouts of comms, and of course data transfer). This is very time consumming and if your are paid more than $10/hour not very profitable. Rockwell factors in their prices the reverse engineering factor. Byte the bullet and use RSLinx.