A Data Leakage Prevention, DLP, device, comprising a network card , to receive an Internet Protocol, IP, packet sent by a user device, and send the IP packet to a driving module , wherein the IP packet comprises Transmission Control Protocol, TCP, port information; the driving module , to receive the IP packet and buffer the IP packet into a user-mode buffer; a forwarding module , to read the IP packet from the user-mode buffer, generate a struct corresponding to the IP packet, and send the struct to a proxy module ; the proxy module , to receive the struct; obtain the TCP port information according to the struct; and detect whether a first TCP connection is established between the DLP device and the user device according to the TCP port information; and if the first TCP connection is not established and when the IP packet is a data packet, send the struct to a Deep Packet Inspection, DPI, module ; and the DPI module , to receive the struct; obtain a packet feature of the IP packet according to the struct; determine an application layer protocol for transmitting the IP packet by comparing the packet feature of the IP packet with packet features corresponding to respective application layer protocols; and send a first message to the proxy module when the application layer protocol for transmitting the IP packet is listened to; wherein the proxy module is further to establish a pair of TCP connections according to the TCP port information after receiving the first message, wherein the pair of TCP connections comprises the first TCP connection and a second TCP connection between the DLP device and a server. a network card , to receive an Internet Protocol, IP, packet sent by a user device, and send the IP packet to a driving module , wherein the IP packet comprises Transmission Control Protocol, TCP, port information; the driving module , to receive the IP packet and buffer the IP packet into a user-mode buffer; a forwarding module , to read the IP packet from the user-mode buffer, generate a struct corresponding to the IP packet, and send the struct to a proxy module ; the proxy module , to receive the struct; obtain the TCP port information according to the struct; and detect whether a first TCP connection is established between the DLP device and the user device according to the TCP port information; and if the first TCP connection is not established and when the IP packet is a data packet, send the struct to a Deep Packet Inspection, DPI, module ; and the DPI module , to receive the struct; obtain a packet feature of the IP packet according to the struct; determine an application layer protocol for transmitting the IP packet by comparing the packet feature of the IP packet with packet features corresponding to respective application layer protocols; and send a first message to the proxy module when the application layer protocol for transmitting the IP packet is listened to; wherein the proxy module is further to establish a pair of TCP connections according to the TCP port information after receiving the first message, wherein the pair of TCP connections comprises the first TCP connection and a second TCP connection between the DLP device and a server. <EOS>