Larry, do you mean the alert shows up on some nodes where you don't expect? Right now, the watchlist alerts you when the item shows up in the MAC address table of any switch. We are looking at modifying the behaviour so the priority is the device shows up for directly connected devices first.
If you do a search for the IP, and change the connection type to All, is the alert showing up on those nodes (where the MAC address appears and the connection type is indirect) or ALL nodes?
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 150,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.