A Data Leakage Prevention (DLP) device and a method for processing a packet are disclosed. The DLP device receives an IP packet sent by a user device, wherein the IP packet includes TCP port information; and detects whether a first TCP connection is established between the DLP device and the user device. If the first TCP connection is not established, when the IP packet is a data packet, an application layer protocol for transmitting the IP packet is determined by comparing a packet feature of the IP packet with packet features corresponding to respective application layer protocols. When the application layer protocol for transmitting the IP packet is listened to, a pair of TCP connections is established according to the TCP port information, wherein the pair of TCP connections includes the first TCP connection and a second TCP connection between the DLP device and a server.