"-E spi@ipaddr algo:secret ..." can be used to decrypt IPSec ESP packets. Because this option involves secret key, it should only be used in debugging purpose. Tcpdump needs to be compiled with cryptography enabled (there is an example about how to use this option).