This boolean switches on matching by the IP protocol number carried in the packet (such as TCP, UDP, or ICMP), letting a rule filter based on which transport or network protocol is being used regardless of specific ports or addresses. An admin uses protocol-based matching to build broad policy like blocking all ICMP for a hardened server, or isolating all UDP traffic for separate inspection, independent of the more granular port-level matching also available in this rule table. For example, an admin wanting to block all ping/traceroute-style ICMP traffic to a sensitive host would set this true and populate cienaCesAclRuleIpProtocol with the ICMP protocol number, rather than trying to enumerate every possible ICMP message type or port combination.