This read-write IpAddress attribute, defaulting to ff.ff.ff.ff, sets the subnet mask associated with the protected IP address entry in this row of the ARP-filtering table. It works alongside hcxEtherIpAddrIPAddr to precisely define the scope of the address being shielded from spoofing. For example, an operator protecting an entire management subnet rather than a single host would adjust this mask accordingly when creating the entry.