It would be great to have something to find rouge switches and or dhcp servers. That usually being small SOHO switches/APs that naughty users will plug into the network.
What would be even better is finding them proactively and alerting on them.
Just a thought.