This is the extended-ACL-table version of cienaCesAclEntryDscpMask, an 8-byte bitmask specifying exactly which of the 64 DSCP values are acceptable for traffic matching this specific source-and-destination extended entry, following the identical big-endian bit-per-DSCP-value encoding as the base table's version. An admin uses this the same way as the base-table DSCP mask -- to further restrict an already source/destination-scoped authorization to only expected QoS markings -- but here the restriction applies to a narrower, already-more-specific source-destination flow rather than a source-only authorization. For example, an admin authorizing a specific partner-to-server flow for a VoIP application might restrict this mask to only DSCP 46, so that flow is rejected on QoS grounds alone if the traffic pattern ever shifts away from the expected voice marking, even though both endpoints remain otherwise correctly authorized.