Tracks MAC address with hostnames seen in DHCP traffic. They are logged into devices.log.
policy/protocols/dns/auth-addl.bro
policy/protocols/conn/weirds.bro