hi,

AFAIK, replay attack generated by Man-in the-middle attack, data recorded - and to be use again. So, IMHO - in the simplest way, 1 person must use 1 ip from 1 mac, connect to any resources one at a time. IPS should aware of this.
preventing MITM by using mac address security on cisco switches.

the hardest part is to capture the initial attack --> man in the middle. with newer tools they have - even encrypted SSL can be catched.

any other idea?

HTH.