fedora seems to have the following package in the repos "dhcp_probe"
Description : dhcp_probe attempts to discover DHCP and BootP servers
on a directly-attached Ethernet network. A network administrator can
use this tool to locate unauthorized DHCP and BootP servers.
Looks like the
man dhcp_probe has some good pointers for DHCP discovery strategy that might be worth a look, even if you decided to go for crafting the packets yourself.
No single request packet is likely to provoke a response from every possible BootP and DHCP server. Some
servers may only response to either BootP, or DHCP, but not both. Some servers may be configured to only
respond to a small set of known clients. Some DHCP servers will only provide leases to a small set of
known clients, but may be willing to respond (negatively) to unknown clients that request a lease renewal
on an inappropriate IP address. Therefore, dhcp_probe actually sends not one, but five different flavor
request packets, in the hopes of provoking responses from a wider variety of unknown servers.
$ rpm -qil dhcp_probe
Name : dhcp_probe
Version : 1.3.0
Release : 8.fc15
Install Date: Mon 30 Apr 2012 12:20:46 AM BST
Group : System Environment/Daemons
Size : 133600
License : GPLv2+ and MIT
Signature : RSA/SHA256, Thu 28 Jul 2011 11:45:40 AM BST, Key ID 067f00b6a82ba4b7
Source RPM : dhcp_probe-1.3.0-8.fc15.src.rpm
Build Date : Tue 08 Feb 2011 01:58:57 PM GMT
Build Host : x86-18.phx2.fedoraproject.org
Relocations : (not relocatable)
Packager : Fedora Project
Vendor : Fedora Project
URL : http://www.net.princeton.edu/software/dhcp_probe/
Summary : Tool for discover DHCP and BootP servers
dhcp_probe attempts to discover DHCP and BootP servers on a directly-attached
Ethernet network. A network administrator can use this tool to locate
unauthorized DHCP and BootP servers.