This notification-carried value reports the IP address of a suspected spoofing DHCP server, derived from the IP header of its offer packet, though the source DESCRIPTION cautions this address cannot always be trusted since a malicious host may forge another host's address. An admin reads this value inside the associated trap as one clue toward locating a rogue DHCP server, while keeping in mind it may be spoofed and should be corroborated with the MAC address and port information. For example, an admin would use this IP address as a starting lead but confirm the actual offending device using the port and MAC address the trap arrived on.