IPv6 has no ARP, no broadcast, and no separate ping protocol - ICMPv6 (RFC 4443) carries all of it, and Neighbor Discovery (RFC 4861) is just five specific ICMPv6 message types. Every example on this page shares one running scenario: a host at fe80::21a:2bff:fe3c:4d5e (MAC 00:1a:2b:3c:4d:5e) resolving and being resolved by 2001:db8::1a2b:3c4d:5e6f - the same host used on the IPv6 Anatomy page. Hover a field to light its bytes, click a field marked + for its lookup table.
Every ICMPv6 message opens with the same 4 bytes; everything after that is message-specific. The type field alone tells a receiver which of the five NDP messages (or which error/informational message) follows.
Example: Time Exceeded, hop limit reached in transit. Checksum shown as a placeholder here since a real one needs a full body - see the message-specific tabs for worked checksums over a complete message.
"Any routers out there?" - lets a host get an immediate RA on boot instead of waiting out the periodic interval, which can be minutes.
Sent from fe80::21a:2bff:fe3c:4d5e to ff02::2, with a Source Link-Layer Address option so the router doesn't need its own NS to reply.
Carries the prefix (via a Prefix Information Option), the M/O/H flags, a router preference, and lifetimes. This is what turns into a SLAAC address on the receiving host.
Example: from fe80::1, advertising 2001:db8::/64, stateless-DHCPv6 (O=1), High preference, 30-minute router lifetime.
"Who has this address?" - the direct ARP-replacement message. Sourced from :: instead of a real address, this exact same message doubles as the Duplicate Address Detection probe.
Resolving 2001:db8::1a2b:3c4d:5e6f - sent to its solicited-node multicast ff02::1:ff4d:5e6f, derived from the target's low 24 bits.
The reply to an NS - or, sent unsolicited ("gratuitous"), a way to update caches proactively. The Override flag is the exact primitive NDP spoofing abuses.
2001:db8::1a2b:3c4d:5e6f answering the NS above, unicast back to the solicitor, Override set.
"Use this other router instead" - the current router telling a host that some other on-link router is a better next-hop for one specific destination.
The router at fe80::1 redirects our host toward fe80::99 for reaching 2001:db8::1a2b:3c4d:5e6f.