From iptables manual page:
-m, --match match
Specifies a match to use, that is, an extension module that tests for a specific property. The set of matches make up the condition under which a target is invoked. Matches are evaluated first to last as specified on the command line and work in short-circuit fashion, i.e. if one extension yields false, evaluation will stop.
In this case
TCP match is being used.
What it does:
These matches are protocol specific and are only available when working with TCP packets and streams. To use these matches, you need to specify
--protocol tcp on the command line before trying to use them. Note that the
--protocol tcp match must be to the left of the protocol specific matches. These matches are loaded implicitly in a sense, just as the UDP and ICMP matches are loaded implicitly. The other matches will be looked over in the continuation of this section, after the TCP match section.