Ingress filtering has been adopted by the IETF as a methodology for preventing denial of service congestive attacks that spoof the source address in packets that are addressed to host server victims. Unless universally adopted by all ISPs on the Internet, however, a packet's source address cannot be totally trusted to be its actual source address. To take advantage of benefits of ingress filtering as it is gradually deployed by ISPs around the Internet, differentiated classes of service are used to transport packets whose source address can be trusted and packets whose source address cannot be trusted. A packet received by an access or edge router at an ISP that supports ingress filtering and has a source address that is properly associated with port on which it is received is forwarded in a privileged class of service and are dropped otherwise. A packet received by access or edge router at an ISP that does not support ingress filtering and whose source address cannot therefore be trusted is transported in an unprivileged class of service. At an intermediate exchange router within an intermediate ISP, where ISPs exchange packets, a packet received from an ISP that doesn't support ingress filtering is forwarded using the unprivileged class of service while a packet received from an ISP that does support ingress filtering is forwarded using the same class of service in which it is already marked.