Provided is an apparatus and method for inspecting a multi-layer packet. The apparatus may include a lower layer processing unit to generate lower layer hash information based on a lower layer packet of the multi-layer packet, and to perform a first processing with respect to a flow of the multi-layer packet, in association with the generated lower layer hash information, and a higher layer preprocessing unit to perform a second processing with respect to a flow of the multi-layer packet where the first processing is performed, in association with the lower layer hash information.