iptables supports filtering at the datalink, network and transport layers.
-p (protocol) option is not specifically limited to layer 4 protocols. The man page mentions icmp and esp specifically. I know that gre is also supported as well (either as 'gre' or protocol '47'). The specified protocol can be passed to this option by name or by its integer number specified in
/etc/protocols. I am not sure that all protocols in this list are supported by iptables.
If the -p or --protocol was specified and if and only if an unknown
option is encountered, iptables will try load a match module of the
same name as the protocol, to try making the option available.
This 'match module' syntax is the extended packet matching module and would be specified by using the
-m --match options.
You can find a list of the supported extensions here: iptables-extensions.
A list of the available netfilter kernel modules are located at