This holds the actual destination IP address this rule matches against, the destination-side analog of cienaCesAclRuleSrcIpAddr, active only when destination-IP matching is enabled for this rule. An admin populates this with the address of the specific host or subnet they want this rule to govern access to, combined with cienaCesAclRuleDstIpAddrPrefixLength to define how broad that destination scope is. For example, an admin protecting a single critical server would set this to that server's exact IP address with a /32 prefix, ensuring the rule applies to that one host and nothing else on its subnet.