A method for dormant data session reactivation may include a packet control function (118) in a radio access network (104) receiving a first data packet (150) having a source IP address (152), where the first data packet has a destination IP address (152) addressed to reactivate a dormant mobile station (102) coupled to the radio access network. The packet control function may receive a plurality of subsequent data packets (160) having the source IP address, where each of the plurality of subsequent data packets has a subsequent destination IP address (162, 164, 166) and a corresponding time stamp (163, 165, 167). For each of the subsequent destination IP addresses that are substantially sequential, evaluating an absolute value of a slope (270) of the difference between the subsequent destination IP addresses that are substantially sequential over a difference in the corresponding time stamps. If the absolute value of the slope is less than a threshold function (280), denying the first data packet and preventing reactivation of the dormant mobile station by the first data packet.