https://www.tcpdump.org/linktypes.html say that DLT_RAW can contain both
types of ip, you just need to peek at the first nibble to figure out
which one it is.

seems reasonable to me.

ok?

Index: print-raw.c
===================================================================
RCS file: /cvs/src/usr.sbin/tcpdump/print-raw.c,v
diff -u -p -r1.9 print-raw.c
--- print-raw.c	1 Dec 2021 18:28:46 -0000	1.9
+++ print-raw.c	5 Jun 2025 05:45:50 -0000
@@ -56,6 +56,7 @@ raw_if_print(u_char *user, const struct 
 {
 	u_int length = h->len;
 	u_int caplen = h->caplen;
+	uint8_t v;
 
 	ts_print(&h->ts);
 
@@ -67,10 +68,27 @@ raw_if_print(u_char *user, const struct 
 	packetp = p;
 	snapend = p + caplen;
 
-	if (eflag)
-		printf("ip: ");
+	if (caplen >= sizeof(v)) {
+		v = *p >> 4;
+		switch (v) {
+		case 4:
+			if (eflag)
+				printf("ip: ");
 
-	ip_print(p, length);
+			ip_print(p, length);
+			break;
+		case 6:
+			if (eflag)
+				printf("ip6: ");
+
+			ip6_print(p, length);
+			break;
+		default:
+			if (eflag)
+				printf("v%u: ", v);
+			break;
+		}
+	}
 
 	if (xflag)
 		default_print(p, caplen);