This value is the wildcard mask paired with aclRuleDestIpAddress, expressed as the 1's complement of a traditional subnet mask, where 'don't care' bits are 1 and 'do care' bits are 0. Admins set it to control how broadly the destination-address match applies, for example matching an entire destination subnet rather than a single host. Because the wildcard convention is inverted from normal subnet masks, admins should double-check it when a rule isn't matching as expected.