I have a client and a server and a third box which sees all packets from the server to the client (but not the other way around). Now when the client requests a file from the server (over HTTP), the third box sees the response. I am trying to reconstruct the file there. I am using libpcap to capture TCP datagrams and trying to reconstruct the file there. Here is what I did

1. Listen for packets on an interface
2. Group all packets which have the same ACK number
3. Sort the group based on SEQ number
4. Extract data from each packet and combine them and write to the disk

The problem is, the file thus generated is not exactly the same as the original file. Does everything sound correct here?

Some more details:

1. I am using C++
2. The packet data is being stored as std::vector<char>
3. I did change the byte order while reading the ack number and seq number from the packet using ntohl
4. I am not sure if I need to change the byte order for the data as well. I tried to reverse the data from each packet before combining them, even that did not work.

Is there something I am missing?