A method includes extracting packet information of a data packet to be transmitted through a Transmission Control Protocol (TCP) connection. If the packet information does not match information in a first data flow table, a first compliance detection is performed on the data packet. A state machine of the TCP connection is obtained if the first compliance detection is successful. The method also includes recording the packet information in the first data flow table, recording a connection status of the TCP connection in a first connection tracking table, and sending the data packet to a receiving end of the TCP connection. If the packet information matches the information in the first data flow table, a second compliance detection is performed on the data packet and, if the second compliance detection fails, the connection status of the TCP connection is adjusted and the data packet is discarded.