All packets on the wire are processed by the analyzer's active capture filters to determine if they should be kept or not. Those packets passed by the capture filters are then moved into the analyzer's packet buffer. Since the packet buffer is a finite area of the analyzer's memory, it has the potential to fill rapidly on a busy network. Once the buffer fills up, the first packets permitted into the buffer are discarded to make room for new packets coming in at the other end of the buffer. The potential problem here is that the packets of interest to the analyst may be lost.
Most analysis is concerned with packet headers.
NetWare Server 5F33.40007954A007 NCP C Data too short to summarize Data too short is only an analyzer comment indicating that the packets were sliced. The trace file identified the user running the SNMP query as workstation 40007754B163. After that it was a simple matter to track down the workstation running the server management software, determine which query had been executed and confirm that the problem could be replicated.