disclosed is a method and apparatus for checking link layer protocol frames such as ethernet frames . the method can be implemented on a processor executing software instructions stored in memory . in one embodiment of the invention , the method includes receiving an ethernet frame , and counting data bytes of the ethernet frame to generate a total number of counted bytes . the total number of counted bytes can be used to calculate a data length of a datagram of the ethernet frame . once calculated , the datagram data length can be compared to a predetermined value . if the datagram length does not fall within an acceptable range of the predetermined value , the ethernet frame may be dropped so that the ethernet frame does not reach its final destination .