Finding Rough Gateways
Nice thread about detecting rough gateways:
http://www.securityfocus.com/archive/101/511334/30/0/threaded
and a nice summary with an example Perl script:
http://blog.rootshell.be/2010/05/25/detecting-rogue-gateways-on-a-lan/