Locating DHCP servers on a LAN from a Microsoft Windows system

Learning that lasts. Online courses from $14.99
If you need to determine the IP addresses of systems on a local area network (LAN) that are functioning as Dynamic Host Configuration Protocol (DHCP) servers, one tool that you can use on systems running a Microsoft Windows operating system is dhcptest, developed by Vladimir Panteleev, aka CyberShadow, a Moldovan developer. He provides a compiled version of the program for Windows systems, which can be run from a command prompt, at dhcptest — there are 32-bit and 64-bit versions of the program there or you can download the 64-bit version from this site here.

When you open the program, type d to have the program send a DHCP discover packet, which should result in responses from DHCP servers on the LAN. You can type Ctrl-C or q to quit the program. 

dhcptest v0.9 - Created by Vladimir Panteleev
https://github.com/CyberShadow/dhcptest
Run with --help for a list of command-line options.

Listening for DHCP replies on port 68.
Type "d" to broadcast a DHCP discover packet, or "help" for details.
d
Sending packet:
  op=BOOTREQUEST chaddr=82:8E:AB:ED:DA:D0 hops=0 xid=BBCE6B0B secs=0 flags=8000
  ciaddr=0.0.0.0 yiaddr=0.0.0.0 siaddr=0.0.0.0 giaddr=0.0.0.0 sname= file=
  1 options:
     53 (DHCP Message Type): discover
Received packet from 192.168.1.1:67:
  op=BOOTREPLY chaddr=F4:39:09:7E:96:5F hops=0 xid=6BC865E0 secs=0 flags=0000
  ciaddr=0.0.0.0 yiaddr=192.168.1.2 siaddr=0.0.0.0 giaddr=0.0.0.0 sname= file=
  7 options:
     53 (DHCP Message Type): offer
     54 (Server Identifier): 192.168.1.1
     51 (IP Address Lease Time): 120 (2 minutes)
      1 (Subnet Mask): 255.255.255.0
      3 (Router Option): 192.168.1.1
      6 (Domain Name Server Option): 208.67.222.222, 208.67.220.220
     15 (Domain Name): midland.local
Received packet from 192.168.1.1:67:
  op=BOOTREPLY chaddr=F4:39:09:7E:96:5F hops=0 xid=6BC865E0 secs=0 flags=0000
  ciaddr=0.0.0.0 yiaddr=192.168.1.2 siaddr=0.0.0.0 giaddr=0.0.0.0 sname= file=
  7 options:
     53 (DHCP Message Type): offer
     54 (Server Identifier): 192.168.1.1
     51 (IP Address Lease Time): 120 (2 minutes)
      1 (Subnet Mask): 255.255.255.0
      3 (Router Option): 192.168.1.1
      6 (Domain Name Server Option): 208.67.222.222, 208.67.220.220
     15 (Domain Name): midland.local
Error on listening thread:
^C
C:\Users\public\Downloads>

You can use the --help parameter to see options for the program.

C:\Users\public\Downloads>dhcptest-0.9-win64 --help
dhcptest v0.9 - Created by Vladimir Panteleev
https://github.com/CyberShadow/dhcptest
Run with --help for a list of command-line options.

Usage: dhcptest-0.9-win64 [OPTION]...

Options:
  --bind IP       Listen on the interface with the specified IP.
                  The default is to listen on all interfaces (0.0.0.0).
                  On Linux, you should use --iface instead.
  --target IP     Instead of sending a broadcast packet, send a normal packet
                  to this IP.
  --bind-port N   Listen on and send packets from this port number instead of
                  the standard 68.
  --target-port N Send packets to this port instead of the standard 67.
  --giaddr IP     Set giaddr to the specified relay agent IP address.
  --iface NAME    Bind to the specified network interface name.  Linux only.
  --raw           Use raw sockets.  Allows spoofing the MAC address in the
                  Ethernet header.  Linux only.  Use with --iface.
  --mac MAC       Specify a MAC address to use for the client hardware
                  address field (chaddr), in the format NN:NN:NN:NN:NN:NN
  --secs          Specify the "Secs" request field (number of seconds elapsed
                  since a client began an attempt to acquire or renew a lease)
  --quiet         Suppress program output except for received data
                  and error messages
  --query         Instead of starting an interactive prompt, immediately send
                  a discover packet, wait for a result, print it and exit.
  --wait          Wait until timeout elapsed before exiting from --query, all
                  offers returned will be reported.
  --option OPTION Add an option to the request packet. The option must be
                  specified using the syntax CODE=VALUE or CODE[FORMAT]=VALUE,
                  where CODE is the numeric option number, FORMAT is how the
                  value is to be interpreted and decoded, and VALUE is the
                  option value. FORMAT may be omitted for known option CODEs
                  E.g. to specify a Vendor Class Identifier:
                  --option "60=Initech Groupware"
                  You can specify hexadecimal or IPv4-formatted options using
                  --option "N[hex]=..." or --option "N[IP]=..."
                  Supported FORMAT types:
                    unknown, str, ip, hex, boolean, u8, u16, u32, time,
                    dhcpMessageType, dhcpOptionType, netbiosNodeType,
                    relayAgent, vendorSpecificInformation,
                    classlessStaticRoute, clientIdentifier, zeroLength
  --request N     Uses DHCP option 55 ("Parameter Request List") to
                  explicitly request the specified option from the server.
                  Can be repeated several times to request multiple options.
  --print-only N  Print only the specified DHCP option.
                  You can specify a desired format using the syntax N[FORMAT]
                  See above for a list of FORMATs. For example:
                  --print-only "N[hex]" or --print-only "N[IP]"
  --timeout N     Wait N seconds for a reply, after which retry or exit.
                  Default is 60 seconds. Can be a fractional number.
                  A value of 0 causes dhcptest to wait indefinitely.
  --tries N       Send N DHCP discover packets after each timeout interval.
                  Specify N=0 to retry indefinitely.

C:\Users\public\Downloads>