The first entry (before the /) is the MAC address to match. The second entry is a mask for that, just like IPv4 network and subnet mask. For example:
02:00:AA:25:00:00 / FF:FF:FF:FF:FF:FF will match exactly and only 02:00:AA:25:00:00
02:00:AA:25:00:00 / FF:FF:FF:00:00:00 will match any that start with 02:00:AA…
00:00:00:00:00:00 / 00:00:00:00:00:00 will match anything (doesn’t matter what is in the first part really)
To give more detail: The mask is applied with a logical AND to the given MAC and the MAC being tested against, then the two results are compared. The effect is to ‘mask off’ the part of the MAC that you do not need to match (usually the part to the right, with the 00’s) leaving only the part to the left that you do wish to match.
If the results are equal, the rule matches. Remember the hex 00, FF, are just representations of a binary sequence and do not have to be fixed at just 00 and FF. You could use C0 (=0b11000000) in the mask to match on just the first two bits of that byte.