A processing method for TCP connection implemented by a protection device, comprising: receiving (S 102) a connection packet sent by a client for establishing a TCP connection with a server; determining (S104) a packet type of the connection packet, wherein the packet type of the connection packet at least includes SYN packet and ACK packet; when the packet type of the connection packet is the SYN packet, counting a packet number of SYN packets within a pre-configured period of time, determining whether the packet number is greater than or equal to a pre-configured threshold, generating connection verification information based on the SYN packets when the packet number is greater than or equal to the threshold, and forwarding the SYN packets to the server when the packet number is smaller than the threshold; when (S 106) the packet type of the connection packet is the ACK packet, utilizing the connection verification information to perform verification of the ACK packet; and when (S 108) the verification of the ACK packet is passed, forwarding the ACK packet to the server, characterized in that after the verification of the ACK packet is passed, the method further comprises: acquiring (S109) a first client address of the client that sends the ACK packet; and saving (S110) the first client address to a pre-created client address list, and wherein, after utilizing the connection verification information to perform verification of the ACK packet, the method further comprises: when (S71) the verification of the ACK packet is not passed, acquiring a second client address of the client that sends the ACK packet; matching (S73) the second client address with the client address list; when (S75) the second client address matches an address in the client address list, forwarding the ACK packet to the server; and when (S77) the second client address does not match any address in the client address list, discarding the ACK packet. receiving (S 102) a connection packet sent by a client for establishing a TCP connection with a server; determining (S104) a packet type of the connection packet, wherein the packet type of the connection packet at least includes SYN packet and ACK packet; when the packet type of the connection packet is the SYN packet, counting a packet number of SYN packets within a pre-configured period of time, determining whether the packet number is greater than or equal to a pre-configured threshold, generating connection verification information based on the SYN packets when the packet number is greater than or equal to the threshold, and forwarding the SYN packets to the server when the packet number is smaller than the threshold; when (S 106) the packet type of the connection packet is the ACK packet, utilizing the connection verification information to perform verification of the ACK packet; and when (S 108) the verification of the ACK packet is passed, forwarding the ACK packet to the server, acquiring (S109) a first client address of the client that sends the ACK packet; and saving (S110) the first client address to a pre-created client address list, and when (S71) the verification of the ACK packet is not passed, acquiring a second client address of the client that sends the ACK packet; matching (S73) the second client address with the client address list; when (S75) the second client address matches an address in the client address list, forwarding the ACK packet to the server; and when (S77) the second client address does not match any address in the client address list, discarding the ACK packet. <EOS>