only acknowledge termination if establishment has previously been acknowledged for a given stream (prevent errors if start sniffing part way through a flow)