The invention provides an IP message processing method and device, wherein, the method comprises the following steps: generating an address resolution protocol ARP interception table entry and a dynamic host setting protocol DHCP interception table entry; extracting the source IP address and the source media access control MAC address of the IP message when the IP message is received,; using thesource IP address and the source MAC address as key fields to match the corresponding fields in the ARP listening table entry and/or the DHCP listening table entry; and processing IP packets accordingto the matching results. The invention solves the technical problem that the normal service message cannot be processed when an IP message attack is initiated in the related art.