The specification claims that TCP with ISN randomization and PAWS provides good replay protection, but gives no proof.