DHCP Snooping Untrusted Port Message Question

[dan.parr1]

Reviewing the log on our Catalyst 6509 I am seeing the following messages from time to time:

Sep 13 14:16:22.061: %DHCP_SNOOPING-5-DHCP_SNOOPING_UNTRUSTED_PORT: DHCP_SNOOPING drop message on untrusted port: GigabitEthernet1/7, message type: DHCPOFFER, MAC sa: 1234.5678.abcd, vlan: 136, server IP: 10.10.10.50

It appears that the MAC sa: 1234.5678.abcd indicates the MAC of the system that sent this offer packet  However this is not the MAC address of the system configured with the IP address of 10.10.10.50.  That IP is the correct IP address of our DHCP Server, which is not connected to GigabitEthernet1/7.  Is this IP address read from inside the offer packet?

I am just looking for clarification on the parts of info provided by this message, and how they are to be interpreted.

Thanks

[salemmahara]

Did you check the result of show mac address-table command to control learned address on specified interface? It might help you to compare message with CAM table. 

Pay attention to the message. DHCP OFFER!