In my LAN I'm using the network 192.0.0.0/24 with a DHCP (192.0.0.14) delivering for the entire LAN through 3 smart switches. Yesterday I found a machine which have received 192.168.2.3 as DNS server by the DHCP, in 192.0.0.14 there is no configuration pointing to this so I tried to find that machine. It looks like a Linux 2.4 box which had 80 open with HTTP authentication (default admin/admin but changed) and DHCP open which only delivers DNS (overwrites 192.0.0.14, it always reply after it). Since switches are "smart" (not that smart indeed) I have no configuration interface where I could create a VLAN and/or block that MAC. Because it is a broadcast I cannot block it on the firewall (since it doesn't pass through it) what can I do to both know which machine is it (a smart and humanized machine) and block it?

Thanks.