h3cDhcpSnoopSpoofServerMac 1.3.6.1.4.1.2011.10.2.36.2.1.1

MAC address of the spoofing server and it is derived from link-layer header of offer packet. If the offer packet is relayed by dhcp relay entity, it may be the MAC address of relay entity.