An apparatus and method for detecting an attack packet in Internet Protocol version 6 (IPv6) are provided. The apparatus includes a control unit, a preprocessing unit, an attack determining unit, and a packet processing unit. The control unit sets a rule for attack determination and a rule for processing of an attack packet. The preprocessing unit decodes an IPv6 packet and a tunneling packet, and divides the decoded packet into each header and payload. The attack determining unit determines possibility of attack of the divided packet according to the rule for attack determination by using information of the divided packet. The packet processing unit performs at least one function of packet filtering, packet deleting, packet forwarding, and intrusion alarming according to a result of the determination of the attack determining unit, and the rule for processing of an attack packet.