This read-write enumerated integer sets which application, identified by well-known port such as ftp(21) or http(80), this Access Control rule applies to, with above1023(65536) covering high ports and none(65537) meaning the rule doesn't match on application at all. An admin uses this to write granular rules that block or permit specific services rather than all traffic between two addresses. For example, an admin wanting to block Telnet access to a device while still permitting SNMP monitoring would set this to telnet(23) on the blocking rule and leave SNMP traffic unaffected by a separate rule.