A security analyst reviewing packet captures notices that an attacker on the same network segment successfully injected forged packets into an established TCP session between a client and an internal application server, taking over the session without knowing the user's credentials. The attacker guessed valid values to make the injected packets appear legitimate to the server. Which control would most directly prevent this type of session takeover?