you can use <s>netstat</s> nmap  for this;
read my answer here:

https://serverfault.com/questions/993783/how-can-i-check-my-pxe-server-configuration/

gathering the different answers and filtering by e.g. mac address you can easily pinpoint the presence of a rogue