Although not typical, it can happen for a number of reasons. For example,...

  • More than one IP address is configured on a computer's network interface (IP aliasing)
  • A wireless network device may do ARP caching on behalf of its clients, for broadcast mitigation
  • A router may be doing Proxy ARP between different networks or subnets
  • A security device may be in the data path or redirecting traffic through itself via ARP Spoofing

Note: Because Home Network alerts are bound to individual MAC addresses, a response from any IP address associated with a MAC address is enough to satisfy the alert criteria (for both Monitored and Controlled alerts).