according to a second aspect of the present invention each per hop behavior has a separate associated anti replay bitmask representing sequence numbers associated with the per hop behavior that were received during a predetermined window such as a thirty two packet window each anti replay bitmask is associated with a defined per hop behavior aggregate such as best effort be one of a set of assured forwarding af per hop behaviors expedited forwarding ef or the like when an input packet is received at the node the dscp field is parsed from the ip header and forwarded to the diffserv codepoint dscp table 57 to determine the contracted level of service associated with the traffic stream there is a correlation between the dscp and the per hop behavior although it may not be a one to one mapping and other considerations such as the type of packet as indicated in the identifier field 12 d of the ip header the ip addresses of the source and destination nodes the protocol associated with the specific packet as identified in field 12 h and other factors may be used to map the packet to one of a set of per hop behavior phb aggregates the present invention recognizes that there may be many phbs defined from many input fields of the packet and the present invention should not be limited to any specific phbs or methods for determining phb aggregates the alternative term of u2018 service level u2019 will be used interchangeably hereinafter with the term per hop behavior aggregate referring now to fig5 logic at the node 50 operates generally as follows when a packet is received at the node the parser 52 strips the dscp field and the sequence.