Is there a way to make a client send out a DHCP discover packet, but not respond to the DHCP offer packets it gets in response? That way you would be able to check the addresses of all responding DHCP servers and not just the one your computer responds too?