I am trying to capture TCP SYN on IPv6 packets but I only get IPv4.

edit

From the pcap-filter man page under the BUGS section:

Arithmetic expression against transport layer headers, like tcp[0], does not work against IPv6 packets. It only looks at IPv4 packets.

Therefore, you can't use a capture filter such as tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and expect it to work with IPv6 packets. What you can do, and as far as I can tell, what you must do (at least for now) is use ip6 offsets to access the relevant byte where the TCP flags of interest are. For example:

-f "(ip6[6] = 6) and (ip6[53] & 0x03 != 0)"

How does this filter work?

• ip6[6] = 6: This checks that the Next Header is TCP, as [6] is the offset to the IPv6 Next Header field (it's the 7th byte, but offsets are zero-based), and 6 is the Assigned Internet Protocol Number for TCP.
• ip6[53] & 0x03 != 0: This checks that either the TCP SYN bit or the FIN bit is set (or both are set), as [53] is the offset to the lower 8 bits of TCP flags field (calculated as 40 bytes for a standard IPv6 header plus 14 more bytes as an additional offset into the TCP Header to get to the TCP flags of interest, again keeping in mind that offsets are zero-based), and then masking the 2 flags of interest, namely SYN and FIN with the & 0x03 part and finally ensuring that the result is non-zero, meaning at least one of those flags is set.
• and: Both conditions must be true for the packet to match the filter.

And don't forget that you can verify the capture filter by running dumpcap -f "(ip6[6] = 6) and (ip6[53] & 0x03 != 0)" -d, which produces the following output (generated on a Windows 10 machine):

(000) ldh      [12]
(001) jeq      #0x86dd          jt 2    jf 7
(002) ldb      [20]
(003) jeq      #0x6             jt 4    jf 7
(004) ldb      [67]
(005) jset     #0x3             jt 6    jf 7
(006) ret      #262144
(007) ret      #0

Now, you might ask yourself why the offset of 20 is used on line 002 and why the offset of 67 is used on line 004 and that's because those are the offsets from the start of the packet, which includes the 14 byte Ethernet bytes as well, so if you subtract 14, you get the offsets I illustrated above.

DISCLAIMER: I calculated the offsets by hand but did not actually test this. It's possible I made a mistake in the offset calculations, so please do test this first.

CAVEATS: If the IPv6 packet contains any extension headers, then this filter will not work as is; however, you should be able to modify the filter to account for them as needed. That is left as an exercise for the reader.

Other References:

• RFC 2460 Internet Protocol, Version 6 (IPv6) Specification, Section 3 IPv6 Header Format
• RFC 793 Transmission Control Protocol, Section 3.1 Header Format
• dumpcap man page

You can have multiple capture filters on the tshark command line but not in a row. Last one in wins.
(if using multiple -f options they are meant to be sprinkled around the interface options)

tshark man page:

-f <capture filter="">
...
This option can occur multiple times. If used before the first occurrence of the -i option, it sets the default capture filter expression. If used after an -i option, it sets the capture filter expression for the interface specified by the last -i option occurring before this option. If the capture filter expression is not set specifically, the default capture filter expression is used if provided.

The second gotcha is filtering ipv6: BPF Byte filter for VLAN-IPv6-UDP stack
From pcap-filter.7:

Note that tcp, udp and other upper-layer protocol types only apply to IPv4, not IPv6 (this will be fixed in the future).

You can try a mix of capture filter with display filter:

$ tshark -i 5 -f "(tcp[tcpflags] & (tcp-syn|tcp-fin) != 0)" -Y ipv6