Hi Patriot,
once polling detects a device, the alert should be sent immediately. Polling interval however defines the time when the device can be detected unless SNMP traps are enabled.. Reason for the alert being sent even if the device is already gone could be too long ARP table flush interval in combination with long polling interval...
Is there any problem in making the polling shorter?
Peter