If the full payload is not stored in the database then an empty pcap file only consisting of a pcap file header is created. An error message is printed to stderr.
Some alert packets seem to have no payload (if you use ACID for example) but this is only for the higher level protocols valid. Only some preprocessor alerts have no payload at all since they may not act on a special network packet (e.g. the sfPortscan preprocessor).
The restriction to ethernet packets is only for the pcap header. Since the data link layer may have different sizes this must be entered in the pcap file header. But this information is not forwarded to the central server. This value can be easily adjusted. Update: The actual version support also the linux cooked mode.
Note: The rebuilt packet also contains the MAC addresses of the ethernet packet and the capture time of the host running snort.
If the reference data is not stored in the event table, getpacket cannot dump all related tagged packets in the pcap file.