This Integer32 object records the IP protocol number a packet must carry to match this General Access List entry, with -1 acting as a wildcard that matches any protocol. An administrator uses it to build protocol-specific rules, for instance separating TCP-based application traffic from ICMP diagnostic traffic. For example, setting this field to 6 restricts the entry to TCP packets only, while leaving it at -1 lets the entry match traffic regardless of protocol.