A method to forward Ethernet frames at a node in a network supporting an implementation of shortest path bridging, SPB, protocol, wherein each Ethernet frame contains a source media access control, MAC, address and a destination MAC address, wherein the node contains a plurality of ports to receive and forward Ethernet frames, wherein the node contains a filtering database, FDB, to guide Ethernet frame forwarding, wherein FDB update is coordinated through a digest exchange between the node and one or more neighboring nodes, and wherein the FDB contains a plurality of mappings of ports to MAC addresses, the method comprising: upon receiving an Ethernet frame from a port of the node, a "receiving port" of the Ethernet frame, determining whether the Ethernet frame is a multicast frame; upon determining the Ethernet frame is a multicast frame, examining at least one of a source MAC address to determine for the receiving port whether in the FDB the source MAC address has a matching MAC address; processing the Ethernet frame for frame forwarding in response to determination that a matching MAC address for the receiving port is found in the FDB for the Ethernet frame; discarding the Ethernet frame in response to determination that no matching MAC address for the receiving port is found in the FDB for the Ethernet frame; and characterised in that upon determining the Ethernet frame is not a multicast frame, sending the Ethernet frame for an alternate ingress check processing, wherein the alternate ingress check processing includes: checking a destination MAC address of the Ethernet frame; determining whether the arrival port of the node, referred to as the computing node, is in a set of permissible ports for the destination MAC address of the Ethernet frame, wherein the ports of the computing node are split into a set of permissible ports of the computing node for the destination MAC address and a set of non-permissible ports of the computing node for the destination MAC address, wherein a port is selected to be a permissible port if said port is facing a set of nodes that are deemed further from the destination node than the computing node; processing the Ethernet frame for frame forwarding in response to determining that the arrival port is in the set of permissible ports for the destination MAC addresses; and discarding the Ethernet frame in response to determining that the arrival port is not in the set of permissible ports for the destination MAC address. upon receiving an Ethernet frame from a port of the node, a "receiving port" of the Ethernet frame, determining whether the Ethernet frame is a multicast frame; upon determining the Ethernet frame is a multicast frame, examining at least one of a source MAC address to determine for the receiving port whether in the FDB the source MAC address has a matching MAC address; processing the Ethernet frame for frame forwarding in response to determination that a matching MAC address for the receiving port is found in the FDB for the Ethernet frame; discarding the Ethernet frame in response to determination that no matching MAC address for the receiving port is found in the FDB for the Ethernet frame; and characterised in that upon determining the Ethernet frame is not a multicast frame, sending the Ethernet frame for an alternate ingress check processing, wherein the alternate ingress check processing includes: checking a destination MAC address of the Ethernet frame; determining whether the arrival port of the node, referred to as the computing node, is in a set of permissible ports for the destination MAC address of the Ethernet frame, wherein the ports of the computing node are split into a set of permissible ports of the computing node for the destination MAC address and a set of non-permissible ports of the computing node for the destination MAC address, wherein a port is selected to be a permissible port if said port is facing a set of nodes that are deemed further from the destination node than the computing node; processing the Ethernet frame for frame forwarding in response to determining that the arrival port is in the set of permissible ports for the destination MAC addresses; and discarding the Ethernet frame in response to determining that the arrival port is not in the set of permissible ports for the destination MAC address. checking a destination MAC address of the Ethernet frame; determining whether the arrival port of the node, referred to as the computing node, is in a set of permissible ports for the destination MAC address of the Ethernet frame, wherein the ports of the computing node are split into a set of permissible ports of the computing node for the destination MAC address and a set of non-permissible ports of the computing node for the destination MAC address, wherein a port is selected to be a permissible port if said port is facing a set of nodes that are deemed further from the destination node than the computing node; processing the Ethernet frame for frame forwarding in response to determining that the arrival port is in the set of permissible ports for the destination MAC addresses; and discarding the Ethernet frame in response to determining that the arrival port is not in the set of permissible ports for the destination MAC address.