This notification-carried value reports the MAC address of a suspected spoofing DHCP server, derived from the link-layer header of its offer packet, noting that if the offer was relayed, this may actually be the relay agent's MAC address instead. An admin reads this value inside the associated trap to begin tracing a rogue DHCP server detected on an untrusted port. For example, a trap carrying this MAC address would give the admin a starting point to locate the physical device sending unauthorized DHCP offers.