DHCP requests are sent to a broadcast address so that you can find an IP without having one or at least without knowing the address of the DHCP server. In this case, the "good" network might be 10.0.0.0/24, and you could scan that, but when someone plugs in a random wireless router it is likely to have and hand out IPs in the 192.168.1.0/24 network which the nmap scan wouldn't find.