1 This module matches IPv6 extension headers and/or upper layer header. 2 .TP 3 .BR "--header " "[!] \fIheader\fP[,\fIheader\fP...]" 4 Matches the packet which EXACTLY includes all specified headers. The headers 5 encapsulated with ESP header are out of scope. 6 .IR header 7 can be 8 .IR hop | hop-by-hop 9 (Hop-by-Hop Options header), 10 .IR dst 11 (Destination Options header), 12 .IR route 13 (Routing header), 14 .IR frag 15 (Fragment header), 16 .IR auth 17 (Authentication header), 18 .IR esp 19 (Encapsulating Security Payload header), 20 .IR none 21 (No Next header) which matches 59 in the 'Next Header field' of IPv6 header or any IPv6 extension headers, or 22 .IR proto 23 which matches any upper layer protocol header. A protocol name from /etc/protocols and numeric value also allowed. The number 255 is equivalent to 24 .IR proto . 25 .TP 26 .BR "[--soft]" 27 Matches if the packet includes all specified headers with 28 .BR --header , 29 AT LEAST. 30
