This field controls whether a rule specifically targets IP-fragmented packets, only non-fragmented (whole/head) packets, or both indiscriminately, letting an admin write security policy that treats fragmented traffic differently from normal whole packets. An admin cares about this because IP fragmentation has historically been abused to evade simpler firewalls or ACLs that only inspect the first fragment's headers, so a rule specifically targeting fragment(2) traffic can be used to flag, rate-limit, or block suspicious fragmented flows that a fragment-blind policy would otherwise let straight through. For example, an admin hardening a public-facing interface might add a rule matching fragment(2) specifically to drop fragmented packets outright, closing off a class of evasion techniques that rely on fragmentation to slip malformed content past inspection.