7.3 Flow Masks
7.3.2 Flow-mask modes
The default flow mask is the destination-ip mode. This is also referred to as a destination flow mask. This mode represents the least-specific flow mask. The MLS-SE maintains one MLS entry for each destination IP address. All flows to a given destination IP address use this MLS entry. This flow mask is used if there are no access lists configured on any of the MLS router interfaces.

The second type of flow mask is the source-destination-ip mode. This is also referred to as a destination-source flow mask. The MLS-SE maintains one MLS entry for each source and destination IP address pair. All flows between a given source and destination use this MLS entry regardless of the IP protocol ports. This mode is used if there is a standard access list on any of the MLS interfaces.

The final flow mask is the ip-flow mode. This is also referred to as a full flow mask. This mode represents the most specific flow mask. The MLS-SE creates and maintains a separate MLS cache entry for every IP flow. An ip-flow entry includes the source IP address, destination IP address, protocol, and protocol ports. This mode is used if there is an extended access list on any MLS interface.