PROTOCOLS-FUN . PACKET ANATOMY

ICMPv6 & Neighbor Discovery Anatomy

RFC 4443 + RFC 4861
rev 2026.08
header 4 bytes + body
ndp types 133-137
checksum pseudo-header
see also ipv6-anatomy.html

IPv6 has no ARP, no broadcast, and no separate ping protocol - ICMPv6 (RFC 4443) carries all of it, and Neighbor Discovery (RFC 4861) is just five specific ICMPv6 message types. Every example on this page shares one running scenario: a host at fe80::21a:2bff:fe3c:4d5e (MAC 00:1a:2b:3c:4d:5e) resolving and being resolved by 2001:db8::1a2b:3c4d:5e6f - the same host used on the IPv6 Anatomy page. Hover a field to light its bytes, click a field marked + for its lookup table.

headertype+code+checksum, 4 bytesspecRFC 4443

Every ICMPv6 message opens with the same 4 bytes; everything after that is message-specific. The type field alone tells a receiver which of the five NDP messages (or which error/informational message) follows.

generic header (4 bytes)

Example: Time Exceeded, hop limit reached in transit. Checksum shown as a placeholder here since a real one needs a full body - see the message-specific tabs for worked checksums over a complete message.

same host, every tab. fe80::21a:2bff:fe3c:4d5e / 00:1a:2b:3c:4d:5e is the same EUI-64 worked example used throughout; 2001:db8::1a2b:3c4d:5e6f is the same target used on the IPv6 Anatomy page. Every checksum on this page is computed for real, not illustrative placeholder math.
type133sent toff02::2 (all-routers)size16 bytes

"Any routers out there?" - lets a host get an immediate RA on boot instead of waiting out the periodic interval, which can be minutes.

Router Solicitation (16 bytes)

Sent from fe80::21a:2bff:fe3c:4d5e to ff02::2, with a Source Link-Layer Address option so the router doesn't need its own NS to reply.

type134sent toff02::1 or unicastsize48 bytes

Carries the prefix (via a Prefix Information Option), the M/O/H flags, a router preference, and lifetimes. This is what turns into a SLAAC address on the receiving host.

Router Advertisement + Prefix Information Option (48 bytes)

Example: from fe80::1, advertising 2001:db8::/64, stateless-DHCPv6 (O=1), High preference, 30-minute router lifetime.

type135sent tosolicited-node multicastsize32 bytes

"Who has this address?" - the direct ARP-replacement message. Sourced from :: instead of a real address, this exact same message doubles as the Duplicate Address Detection probe.

Neighbor Solicitation (32 bytes)

Resolving 2001:db8::1a2b:3c4d:5e6f - sent to its solicited-node multicast ff02::1:ff4d:5e6f, derived from the target's low 24 bits.

type136sentunicast reply, or multicast gratuitoussize32 bytes

The reply to an NS - or, sent unsolicited ("gratuitous"), a way to update caches proactively. The Override flag is the exact primitive NDP spoofing abuses.

Neighbor Advertisement (32 bytes)

2001:db8::1a2b:3c4d:5e6f answering the NS above, unicast back to the solicitor, Override set.

type137sentunicast, router to hostsize40 bytes

"Use this other router instead" - the current router telling a host that some other on-link router is a better next-hop for one specific destination.

Redirect (40 bytes, no options)

The router at fe80::1 redirects our host toward fe80::99 for reaching 2001:db8::1a2b:3c4d:5e6f.