I have been talking to my network administration team about false alerts usually due to a missed poll. The way I understand NPM to work is that if a single poll is missed then the node status is changed to warning. The node is then placed into fastpoll mode, whereby if the next polls are missed the node status is changed to down. We have several diffrent pollers that reside in several locations.
Their suggestion is that if the primary poll misses from the primary location the secondary polls can be configured to occur from one of the secondary pollers. So that you have verified that the node is down from two diffrent hosts/network routes.