This is the destination-side counterpart to cienaCesAclRuleMatchSrcIpAddr, switching on matching against where traffic is headed at the IP layer rather than where it came from, and it likewise activates a paired type/address/prefix-length trio of fields when set true. An admin uses destination-IP matching to protect a specific server or subnet by controlling what's allowed to reach it, which is a fundamentally different security posture from source-based filtering that instead controls where traffic from a given origin is allowed to go. For example, an admin protecting a sensitive internal database server would write a rule matching that server's specific destination IP and deny all but a short allow-list of known application-server sources.