VMware ESX servers have SLP (Service Discovery Protocol) enabled by default making it easy to discover all ESX servers in a given subnet through any SLP client. For example, on linux, running the following will list all the ESX servers in the current subnet:

~$ slptool findsrvs VMwareInfrastructure

service:VMwareInfrastructure://esxhost101.mydatacenter.com,65535

service:VMwareInfrastructure://localhost.localdomain,65535

You will need to have multicast enabled in the subnet.

You can also get additional details, such as BIOS UUID and version:

slptool findattrs service:VMwareInfrastructure://esxhost101.mydatacenter.com

(product="VMware ESXi 5.5.0 build-2068190"),(hardwareUuid="511854B6-F07F-E311-B547-001E67A945C5")