This is the mask paired with cienaCesAclRuleDstMacAddr, allowing the rule to match a range of destination addresses (like an OUI-based vendor block) instead of a single exact address, and it too is inert unless cienaCesAclRuleMatchDstMacAddr is true. An admin would use a partial mask here to write a single rule covering all devices from a given manufacturer as the traffic destination, rather than needing one rule per individual device MAC. For example, a mask of ff:ff:ff:00:00:00 combined with a destination address sharing a common OUI would let one rule govern traffic destined toward any device from that vendor, rather than requiring separate rules per device.