This holds the actual source IP address (in the format determined by the paired address-type field) this rule matches against, meaningful only when cienaCesAclRuleMatchSrcIpAddr is true. An admin combines this with cienaCesAclRuleSrcIpAddrPrefixLength to specify either a single host or an entire subnet as the source criterion, making this one of the most frequently configured fields in any practical ACL deployment. For example, an admin blocking a known attacker's network would set this to that network's address paired with an appropriate prefix length to cover the entire announced subnet rather than just one host within it.