nmap – looking for rogue devices

General network discovery
nmap -sV –allports -T4 192.168.1.0/24

Rogue DHCP servers
nmap –script broadcast-dhcp-discover -e eth0

UPnP devices
nmap -sV –script=broadcast-upnp-info -T4 192.168.1.0/24