From pfhunt on SourceForge:

From pfhunt on SourceForge:

When a packet contains an IPv6 options header followed by an unknown IPv6
protocol payload, tcpdump displays the proto ID for the known option
header, not for the unknown payload.

For example, this is the output for an IPv6 packet containing a destination
options header, followed by a payload of (unknown) protocol 138:

# tcpdump -s 128 -i eth1
tcpdump: WARNING: addresses not searched
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 128 bytes
11:44:40.862572 I IP6 2007::10:5:2:163 > 2007::10:5:2:164: DSTOPT ip-proto-60 16

The ip-proto-60 refers to the destination option header (DSTOPT), rather
than displaying the unknown option 138, which I think would be more
informative.

The attached patch fixes this problem. With the patch applied, the output
for the packet is:

# tcpdump -s 128 -i eth1
tcpdump: WARNING: addresses not searched
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 128 bytes
11:48:26.160462 I IP6 2007::10:5:2:163 > 2007::10:5:2:164: DSTOPT ip-proto-138 16