This module matches IPv6 extension headers and/or upper layer header.
.TP
.BR "--header " "[!] \fIheader\fP[,\fIheader\fP...]"
Matches the packet which EXACTLY includes all specified headers. The headers
encapsulated with ESP header are out of scope.
.IR header
can be
.IR hop | hop-by-hop
(Hop-by-Hop Options header),
.IR dst
(Destination Options header),
.IR route
(Routing header),
.IR frag
(Fragment header),
.IR auth
(Authentication header),
.IR esp
(Encapsulating Security Payload header),
.IR none
(No Next header) which matches 59 in the 'Next Header field' of IPv6 header or any IPv6 extension headers, or
.IR proto
which matches any upper layer protocol header. A protocol name from /etc/protocols and numeric value also allowed. The number 255 is equivalent to
.IR proto .
.TP
.BR "[--soft]"
Matches if the packet includes all specified headers with
.BR --header ,
AT LEAST.