A method and apparatus for controlling data packet flooding in a data-communication network to promote network security and provide for more efficient utilization of network resources. One or more network nodes include a flooding disable device, for example a disable bit in a L2 hardware lookup table associated with a particular device in an Ethernet application. When the disabler is set, packets from the particular device are not flooded on all ports even when the node cannot associate a particular port with the packets' intended destination. The flooding disable in the network node may be set statically or dynamically, either by a network operator or by a communication received from a server or other network device.