Although not typical, it can happen for a number of reasons. For example,...
- More than one IP address is configured on a computer's network interface (IP aliasing)
- A wireless network device may do ARP caching on behalf of its clients, for broadcast mitigation
- A router may be doing Proxy ARP between different networks or subnets
- A security device may be in the data path or redirecting traffic through itself via ARP Spoofing
Note: Because Home Network alerts are bound to individual MAC addresses, a response from any IP address associated with a MAC address is enough to satisfy the alert criteria (for both Monitored and Controlled alerts).