A method and apparatus of a device that monitors a link for a slow link flap event is described. In an exemplary embodiment, a device detects a link flap in a current time interval of a link that couples a pair of devices. In addition, the current time interval is one of a plurality of time intervals that are used to monitor the link for a slow link flap. Furthermore, a slow link flap event results from detecting a maximum number of link flap violations over the plurality of time intervals. The device additionally increments a number of detected link flaps for the current time interval. If the number of detected link flaps for the current time interval is greater than a maximum number of slow link flap violations, the device marks the current time interval as a possible slow link flap interval. In addition, if the total number of intervals among the current time interval and one or more preceding time intervals, which are marked as possible slow flap intervals, equals the maximum number of slow flap intervals, the device brings the link down.