The current implementation of the packet filtering keyword 'atalk' in 
libpcap just doesn't work.  I've fixed my local copy of libpcap so that 
'tcpdump atalk' actually dumps only AppleTalk packets (and perhaps more
important to some people, 'tcpdump not atalk' dumps everything _but_ 
AppleTalk packets ;).  How would I go about submitting this change?

-- monroe