Suricata

The new (in 7) "stream" eve record type might be able to already help here. It logs the flags that include midstream:

{
  "timestamp": "2016-07-14T00:42:07.573174+0200",
  "flow_id": 1983485797392474,
  "pcap_cnt": 9,
  "event_type": "stream_tcp",
  "src_ip": "10.16.1.11",
  "src_port": 54186,
  "dest_ip": "82.165.177.154",
  "dest_port": 80,
  "proto": "TCP",
  "pkt_src": "wire/pcap",
  "direction": "to_server",
  "stream_tcp": {
    "packet": {
      "len": 40,
      "tos": 0,
      "ttl": 64,
      "ipid": 36763,
      "tcpseq": 2059970576,
      "tcpack": 2548486955,
      "tcpwin": 237,
      "syn": false,
      "ack": true,
      "psh": false,
      "rst": false,
      "urg": false,
      "fin": false,
      "tcpres": 0,
      "tcpurgp": 0,
      "flags": [
        "state_update" 
      ]
    },
    "session": {
      "state": "closed",
      "pstate": "last_ack",
      "flags": {
        "flags": [
          "midstream",
          "midstream_synack",
          "3whs_confirmed" 
        ]
      },
      "client": {
        "isn": 2059970493,
        "next_seq": 2059970576,
        "last_ack": 2059970576,
        "next_win": 2060012943,
        "base_seq": 2059970494,
        "segs_right_edge": 2059970575,
        "window": 42368,
        "wscale": 7,
        "flags": [
          "appproto_detection_completed" 
        ]
      },
      "server": {
        "isn": 2548486694,
        "next_seq": 2548486955,
        "last_ack": 2548486955,
        "next_win": 2552369962,
        "base_seq": 2548486695,
        "segs_right_edge": 2548486954,
        "window": 3883008,
        "wscale": 14,
        "flags": [
          "appproto_detection_completed" 
        ]
      }
    }
  }
}