Try dhcp-discover
Sends a DHCPINFORM request to a host on UDP port 67 to obtain all the local configuration parameters without allocating a new address.
DHCPINFORM is a DHCP request that returns useful information from a DHCP server, without allocating an IP address. The request sends a list of which fields it wants to know (a handful by default, every field if verbosity is turned on), and the server responds with the fields that were requested. It should be noted that the server doesn't have to return every field, nor does it have to return them in the same order, or honour the request at all. A Linksys WRT54g, for example, completely ignores the list of requested fields and returns a few standard ones. This script displays every field it receives.
Example Usage
nmap -sU -p 67 --script=dhcp-discover <target>
Output
Interesting ports on 192.168.1.1:
PORT STATE SERVICE
67/udp open dhcps
| dhcp-discover:
| DHCP Message Type: DHCPACK
| Server Identifier: 192.168.1.1
| IP Address Lease Time: 1 day, 0:00:00
| Subnet Mask: 255.255.255.0
| Router: 192.168.1.1
|_ Domain Name Server: 208.81.7.10, 208.81.7.14
Loop through the hosts in your subnet until you find dhcp server.
Reference