you can use <s>netstat</s> nmap  for this;
read my answer here:

https://serverfault.com/questions/993783/how-can-i-check-my-pxe-server-configuration/

gathering the different answers and filtering by e.g. mac address you can easily pinpoint the presence of a rogue


It should be considered that PXE information (NBP and TFTP server IP) can be located either at the body of the DHCPOFFER packet (`file` and `next-server` fields) or as the corresponding DHCP options.