Both the network layer and, if used, the application layer build their encryption around a packet counter that must never repeat for a given key. The receiving side is required to keep track of received packet counters and reject duplicates, and the Application Layer Specification names this explicitly as the protection against replay attacks in the uplink direction. For downlink, tying encrypted application data to one specific packet counter also mitigates known-plaintext attacks if a message were ever resent.