One very, very inefficient way can be tracerouting all the host addresses on the network and traversing the resulting nodes into a tree structure, and then looking for your "device"'s position in the resulting tree. If it has leafs, you can more or less assume it does some sort of "routing".
But this is a sloppy approach. The device may have been configured to not respond traceroutes or any ICMP packets. Or it may just be idling there without nothing else connected to it(There can be several - needless to say; bad - reasons for this; there may be installation and cabling going on, someone may have unintentionally unplugged cables, rookies are fiddling with the network consistency, integrity, and security - that one is me.). Your traffic may hit a road block, like a firewall. Ports, hosts, protocols, devices may not be available at the moment. Moreover, topology changes in a sufficiently large network is not that uncommon.
Therefore, I would "reinforce" my tree building algorithm. Some SNMP, LLDP, and/or CDP integration would help a lot. I would revisit each host periodically, and "test" it over and over to try to figure out multiple paths. Sniffing out local wireless and port mapping each host can also provide information of interest.
Yet, at best, this will be an estimation. It will generate a lot of traffic, and may degrade network. This much traffic may also cause your end to be flagged as suspicious activity and you may - if it were a network I was managing, you would definitely - be "cut" from the network at the first sign of port scanning.