FinalSnapshot should be last one in state ESTABLISHED

[gfr10598]

The trailing snapshots my be e.g. in FIN_WAIT2 or CLOSED, and missing some message types. When we use FinalSnapshot, we usually want the last ESTABLISHED snapshot.