Larry, do you mean the alert shows up on some nodes where you don't expect? Right now, the watchlist alerts you when the item shows up in the MAC address table of any switch. We are looking at modifying the behaviour so the priority is the device shows up for directly connected devices first.
If you do a search for the IP, and change the connection type to All, is the alert showing up on those nodes (where the MAC address appears and the connection type is indirect) or ALL nodes?
