Are applications aware of data records received before and after tls rehandshake?
Section II-B talks about this. The answer to this is implementation-dependent. For example, if you're using GnuTLS, you can get some non-fatal error codes if you try to read after parameters change. Then you can look in your logs and distinguish data from before you got the error code from data that's timestamped afterwards. But you may have to be actively looking or polling for it.

You may have better luck on Stack Overflow with this one for particular implementations.