Tcpdump is not able to filter packets in pcap files when ethertype 802.1Q header is present:
$ tcpdump --version
tcpdump version 4.99.0
libpcap version 1.10.0
OpenSSL 1.1.1i 8 Dec 2020
$ tcpdump -n -e -r ./test.pcap
reading from file ./test.pcap, link-type EN10MB (Ethernet), snapshot length 1500
12:23:40.763084 xx:xx:d4:82:38:24 > xx:xx:xx:43:66:40, ethertype 802.1Q (0x8100), length 76: vlan 31, p 0, ethertype IPv4 (0x0800), 10.11.27.62.53 > 10.15110.19.45002: 8089 Refused- 0/0/0 (30)
...
$ tcpdump -n -e -r ./test.pcap ip
reading from file ./test.pcap, link-type EN10MB (Ethernet), snapshot length 1500
$ (no packet is shown)
Most probably the same issue is present for IPv6 packets.
Tcpdump is not able to filter packets in pcap files when ethertype 802.1Q header is present:
$ tcpdump --version
tcpdump version 4.99.0
libpcap version 1.10.0
OpenSSL 1.1.1i 8 Dec 2020
$ tcpdump -n -e -r ./test.pcap
reading from file ./test.pcap, link-type EN10MB (Ethernet), snapshot length 1500
12:23:40.763084 xx:xx:d4:82:38:24 > xx:xx:xx:43:66:40, ethertype 802.1Q (0x8100), length 76: vlan 31, p 0, ethertype IPv4 (0x0800), 10.11.27.62.53 > 10.15110.19.45002: 8089 Refused- 0/0/0 (30)
...
$ tcpdump -n -e -r ./test.pcap ip
reading from file ./test.pcap, link-type EN10MB (Ethernet), snapshot length 1500
$ (no packet is shown)
Most probably the same issue is present for IPv6 packets.