youYou can use netstat nmap for this;
read my answer here:
https://serverfault.com/questions/993783/how-can-i-check-my-pxe-server-configuration/
gatheringGathering the different answers and filtering by e.g. macMAC address, you can easily pinpoint the presence of a rogue PXE server.
It should be considered that PXE information (NBP and TFTP server IP) can be located either at the body of the DHCPOFFER packet (file
and next-server
fields) or as the corresponding DHCP options.