Want to know the DNS names and IP addresses of all DHCP servers on your network? If you’re using Active Directory it’s easy, just open a command prompt and type netsh dhcp show server and a list of DHCP servers authorized in AD will be displayed.
But what about rogue DHCP servers? These are not displayed, and the only way you can scan for such DHCP servers is to use a sniffer like Network Monitor to capture all DHCP broadcast traffic on your network. Leave Network Monitor running for some time however to do this since most DHCP leases are 8 days or so.
