This is the bitmask paired with cienaCesAclRuleSrcMacAddr, letting the rule match a range of MAC addresses (such as all devices from a given vendor OUI) rather than requiring an exact single-address match, and like its address counterpart it's meaningless unless cienaCesAclRuleMatchSrcMacAddr is true. An admin uses a partial mask specifically to match by vendor OUI (the first three bytes of a MAC, identifying the manufacturer) when they want to allow or block an entire class of hardware rather than one specific device. For example, setting the mask to ff:ff:ff:00:00:00 alongside a source MAC address whose first three bytes identify a specific vendor would match any device from that manufacturer, regardless of the device-specific last three bytes.