Sticky MAC Access Policy – Preventing Unauthorized Hubs

Short answer: No.

Long answer: You can narrow down your list to a few candidates. The first 3 bytes of the MAC address is called the OUI (Organizationally Unique Identifier) and is assigned to manufacturers. You can look up the manufacturer of a MAC address by using a tool like http://www.wireshark.org/tools/oui-lookup.html

Based on the manufacturer, you can get a pretty good idea of who is who. If the manufacturer is "Cisco," odds are it's an AP. If the mfr is "Dell," it's probably a PC. This isn't perfect, but as you collect more data, you will able to be more certain of your results.

MAC address filtering itself does not provide much protection. As you pointed out, a MAC address can be cloned. That doesn't mean it can't be part of the overall defense strategy, but it can be a lot of work for very little return.

You need a comprehensive security policy which can include such things as:

• Physical access limitations
• 802.1X as @robut mentioned, albeit this can be complex and require supporting hardware/software infrastructure, while frustrating legitimate users
• Port security on switches can be set up to only allow a single (or limited number of) MAC address at any given time, or in any given time period, to prevent connection of hubs, switches, APs, etc., including a port disable for a given time period if violations are detected (care needs to be taken for things like VoIP phones where PCs are connected to the phone since the phone itself will have one or more MAC addresses)
• You could also implement a policy that requires any switch ports that are not currently used to be disabled (including, perhaps, making sure that unused network cables are not cross-connected in the data closet)

As a locksmith friend of mine once told me, "Locks only keep honest people honest." The bad guys will always find a way; your job is to make it not worth their efforts. If you provide enough layers of protection, only the most determined bad guys will spend the time and effort.

You have to weigh the risks with the resources (primarily time and money, but lost productivity, too) that you are willing to put into securing your network. It may not make much sense to spend thousands of dollars and many man hours to protect that garage-sale bicycle you bought for $10. You need to come up with a plan and decide how much risk you can tolerate.