diff --git a/net/src/main/java/com/zfoo/net/handler/codec/jprotobuf/JProtobufTcpCodecHandler.java b/net/src/main/java/com/zfoo/net/handler/codec/jprotobuf/JProtobufTcpCodecHandler.java
index 0b5ea5ad..be417ef3 100644
--- a/net/src/main/java/com/zfoo/net/handler/codec/jprotobuf/JProtobufTcpCodecHandler.java
+++ b/net/src/main/java/com/zfoo/net/handler/codec/jprotobuf/JProtobufTcpCodecHandler.java
@@ -23,6 +23,7 @@ import com.zfoo.net.util.SessionUtils;
 import com.zfoo.protocol.IPacket;
 import com.zfoo.protocol.ProtocolManager;
 import com.zfoo.protocol.buffer.ByteBufUtils;
+import com.zfoo.protocol.util.IOUtils;
 import com.zfoo.protocol.util.StringUtils;
 import io.netty.buffer.ByteBuf;
 import io.netty.channel.ChannelHandlerContext;
@@ -55,8 +56,8 @@ public class JProtobufTcpCodecHandler extends ByteToMessageCodec<EncodedPacketIn
         in.markReaderIndex();
         var length = in.readInt();
 
-        // 如果长度非法，则抛出异常断开连接
-        if (length < 0) {
+        // 如果长度非法，则抛出异常断开连接，按照自己的使用场景指定合适的长度，防止客户端发送超大包占用带宽
+        if (length < 0 || length > IOUtils.BYTES_PER_MB) {
             throw new IllegalArgumentException(StringUtils.format("[session:{}]的包头长度[length:{}]非法"
                     , SessionUtils.sessionInfo(ctx), length));
         }
diff --git a/net/src/main/java/com/zfoo/net/handler/codec/tcp/TcpCodecHandler.java b/net/src/main/java/com/zfoo/net/handler/codec/tcp/TcpCodecHandler.java
index f9dc89f2..88168ff4 100644
--- a/net/src/main/java/com/zfoo/net/handler/codec/tcp/TcpCodecHandler.java
+++ b/net/src/main/java/com/zfoo/net/handler/codec/tcp/TcpCodecHandler.java
@@ -18,6 +18,7 @@ import com.zfoo.net.packet.model.DecodedPacketInfo;
 import com.zfoo.net.packet.model.EncodedPacketInfo;
 import com.zfoo.net.packet.service.PacketService;
 import com.zfoo.net.util.SessionUtils;
+import com.zfoo.protocol.util.IOUtils;
 import com.zfoo.protocol.util.StringUtils;
 import io.netty.buffer.ByteBuf;
 import io.netty.channel.ChannelHandlerContext;
@@ -48,8 +49,8 @@ public class TcpCodecHandler extends ByteToMessageCodec<EncodedPacketInfo> {
         in.markReaderIndex();
         var length = in.readInt();
 
-        // 如果长度非法，则抛出异常断开连接
-        if (length < 0) {
+        // 如果长度非法，则抛出异常断开连接，按照自己的使用场景指定合适的长度，防止客户端发送超大包占用带宽
+        if (length < 0 || length > IOUtils.BYTES_PER_MB) {
             throw new IllegalArgumentException(StringUtils.format("[session:{}]的包头长度[length:{}]非法"
                     , SessionUtils.sessionInfo(ctx), length));
         }
diff --git a/net/src/main/java/com/zfoo/net/handler/codec/udp/UdpCodecHandler.java b/net/src/main/java/com/zfoo/net/handler/codec/udp/UdpCodecHandler.java
index 40c9dea0..26515e32 100644
--- a/net/src/main/java/com/zfoo/net/handler/codec/udp/UdpCodecHandler.java
+++ b/net/src/main/java/com/zfoo/net/handler/codec/udp/UdpCodecHandler.java
@@ -18,6 +18,7 @@ import com.zfoo.net.packet.model.EncodedPacketInfo;
 import com.zfoo.net.packet.service.PacketService;
 import com.zfoo.net.router.attachment.UdpAttachment;
 import com.zfoo.net.util.SessionUtils;
+import com.zfoo.protocol.util.IOUtils;
 import com.zfoo.protocol.util.JsonUtils;
 import com.zfoo.protocol.util.StringUtils;
 import io.netty.buffer.ByteBuf;
@@ -51,8 +52,8 @@ public class UdpCodecHandler extends MessageToMessageCodec<DatagramPacket, Encod
         in.markReaderIndex();
         var length = in.readInt();
 
-        // 如果长度非法，则抛出异常断开连接
-        if (length < 0) {
+        // 如果长度非法，则抛出异常断开连接，按照自己的使用场景指定合适的长度，防止客户端发送超大包占用带宽
+        if (length < 0 || length > IOUtils.BYTES_PER_MB) {
             throw new IllegalArgumentException(StringUtils.format("[session:{}]的包头长度[length:{}]非法"
                     , SessionUtils.sessionInfo(channelHandlerContext), length));
         }
diff --git a/net/src/main/java/com/zfoo/net/handler/codec/websocket/WebSocketCodecHandler.java b/net/src/main/java/com/zfoo/net/handler/codec/websocket/WebSocketCodecHandler.java
index a0468f27..f3c77f5e 100644
--- a/net/src/main/java/com/zfoo/net/handler/codec/websocket/WebSocketCodecHandler.java
+++ b/net/src/main/java/com/zfoo/net/handler/codec/websocket/WebSocketCodecHandler.java
@@ -18,6 +18,7 @@ import com.zfoo.net.packet.model.DecodedPacketInfo;
 import com.zfoo.net.packet.model.EncodedPacketInfo;
 import com.zfoo.net.packet.service.PacketService;
 import com.zfoo.net.util.SessionUtils;
+import com.zfoo.protocol.util.IOUtils;
 import com.zfoo.protocol.util.JsonUtils;
 import com.zfoo.protocol.util.StringUtils;
 import io.netty.buffer.ByteBuf;
@@ -54,8 +55,8 @@ public class WebSocketCodecHandler extends MessageToMessageCodec<WebSocketFrame,
         in.markReaderIndex();
         var length = in.readInt();
 
-        // 如果长度非法，则抛出异常断开连接
-        if (length < 0) {
+        // 如果长度非法，则抛出异常断开连接，按照自己的使用场景指定合适的长度，防止客户端发送超大包占用带宽
+        if (length < 0 || length > IOUtils.BYTES_PER_MB) {
             throw new IllegalArgumentException(StringUtils.format("[session:{}]的包头长度[length:{}]非法"
                     , SessionUtils.sessionInfo(channelHandlerContext), length));
         }