Avoid TCP log messages which are false positives.

The check for timestamps are too early to handle SYN-ACK correctly.
So move it down after the corresponing processing has been done.

PR: 216832
Obtained from: antonfb@hesiod.org
MFC after: 1 week