Hi,
Why not to ask the person operating the firewall? There should be no security issue in giving this information.
Besides: the network mask received by DHCP gives you an upper limit. There might, however, be reserved IP ranges not available through DHCP.
Another approach would be to use denial-of-service tools flooding the firewall with DHCP requests. Security people will not appreciate this at all and I recommend not ever to use this in a production environment. (should only be used for security audits and in test environment).
So the simplest approach will be to ask the firewall admins.
Regards, Martin
