Keep in mind that unless told differently most network utilities like ethereal and tcpdump will only capture the first n bytes of each packet (n being somewhere around 50-60 bytes, just enough to catch all of the headers but not necessarily all of the data). The HTTP requests were probably sending a full MTU's worth of data, so you probably only have 50-60 bytes of about 1400 for each packet, which would explain why you're only seeing about 1% when you try and reassemble it.