Patent ID: 8646090

Claim:
A method comprising: receiving, by a network device, a plurality of packets, each of the plurality of packets including an anti-replay sequence number; determining, by the network device, that the anti-replay sequence number of a particular packet, of the plurality of packets, exceeds an upper limit of a predetermined range of anti-replay sequence numbers; shifting, by the network device, the predetermined range of anti-replay sequence numbers by an amount that is based on the anti-replay sequence number of the particular packet, a highest number of the predetermined range of anti-replay sequence numbers being equal to the anti-replay sequence number of the particular packet; determining, by the network device and when another anti-replay sequence number of another packet, of the plurality of packets, falls below the shifted predetermined range of anti-replay sequence numbers, whether the anti-replay number of the other packet falls within an extended range of anti-replay sequence numbers, the extended range of anti-replay sequence numbers comprising an upper limit that is defined by a lower limit of the shifted predetermined range of anti-replay sequence numbers; determining, by the network device and when the anti-replay sequence number of the other packet falls within the extended range, whether the other packet arrived at the network device before the particular packet by less than a threshold amount of time, the threshold amount of time being based on a maximum delay associated with processing the plurality of packets; and selectively: retaining the other packet when the other packet arrived at the network device before the particular packet by less than the threshold amount of time; or dropping the other packet when the other packet did not arrive at the network device before the particular packet by less than the threshold amount of time.