This counter tracks lookups that matched on source/destination subnet criteria but were rejected because the packet's IP protocol wasn't one that specific subnet-based entry permits, adding a fourth distinct rejection-reason counter (alongside no-hit, bad-port, and bad-DSCP) to this legacy ACL's diagnostic toolkit. An admin sees this climbing when an otherwise-authorized source/destination pairing is sending traffic using a protocol the ACL entry wasn't configured to allow. For example, if a partner network starts a new service using GRE tunneling that wasn't part of the originally authorized protocol set for their subnet's ACL entry, this counter would begin incrementing even though their source subnet itself remains correctly authorized.