If I have got a list of MAC addresses, is there any possible way to differentiate MAC of an AP from that of a Client. I am asking whether there is any pattern of the characters in the MAC address by which we can identify it belongs to an Access Point?
Short answer: No.
Long answer: You can narrow down your list to a few candidates. The first 3 bytes of the MAC address is called the OUI (Organizationally Unique Identifier) and is assigned to manufacturers. You can look up the manufacturer of a MAC address by using a tool like http://www.wireshark.org/tools/oui-lookup.html
Based on the manufacturer, you can get a pretty good idea of who is who. If the manufacturer is "Cisco," odds are it's an AP. If the mfr is "Dell," it's probably a PC. This isn't perfect, but as you collect more data, you will able to be more certain of your results.
I use http://www.macvendorlookup.com/ on an almost daily basis to aid in forensics.
I.e. If you have a mac address you can them obtain the manufacturer to guess at what the machine is. Then you can use only that mac address to find out other information
MY-IDF-2960-241#sho mac address-table interface f0/25 Mac Address Table ------------------------------------------- Vlan Mac Address Type Ports ---- ----------- -------- ----- 48 0010.492b.dbcb DYNAMIC Fa0/25 100 b8ca.3aa5.6f77 DYNAMIC Fa0/25 Total Mac Addresses for this criterion: 2 MY-IDF-2960-241# MY-MDF-4500X-1#sho arp | in 6f77 Internet 10.220.103.1 0 b8ca.3aa5.6f77 ARPA Vlan100 MY-MDF-4500X-1# C:\Users\superstar>ping -a 10.220.103.1 Pinging XXX-XXXX-WWK.supersecretdomainname.local [10.220.103.1] with 32 bytes of data: Reply from 10.220.103.1: bytes=32 time<1ms TTL=128 Reply from 10.220.103.1: bytes=32 time<1ms TTL=128 Reply from 10.220.103.1: bytes=32 time<1ms TTL=128 Reply from 10.220.103.1: bytes=32 time<1ms TTL=128
In the above example I took the mac address off of a port, found its IP via arp entries on my core switch, then found the hostname via a "ping -a" from my workstation. http://www.macvendorlookup.com/ lets us know that the mac was made by Dell so at this point we can
1) Logically locate the machine on the network
2) Physically locate the machine on premises
3) test further for open tcp ports to the host to guess what operating system is running
This may seem like a lengthy process but you can get quite fast at it and it definitely helps when you're mapping out the network of a new client.
P.S. If you look up the other mac address from my post, you can probably determine something else about the network I pull this output from.
Well, by simply looking at it? Not exactly.
There are obvious things you can do such as:
1. Look at the OUI (First 3 bytes of MAC) and see who owns it and just assume which is MORE LIKELY to be AP.
2. Look at a packet capture and see what information is going to/from the MAC.
Just remember that spoofing a MAC address is very easy.