Disclaimer
The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.
Liability Disclaimer
In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.
Posting
As Peter noted, it's normally impossible to detect unmanaged switches as they don't have a "presence" on the network as themselves.
For managed switches, as Peter also described, they often generate "special" L2 control frames, that if "sniffed" would reveal their presence, and depending on the type of control frame, might reveal information about the switch.
However there's another method that often will reveal managed switches, although it is not 100% reliable. This would be active probing address scans against different ports. A managed switch will often respond on its managed address to pings, SNMP, telnet and/or http. How the switch responds, might provide additional clues to what device it is. What address it responds on, also often provides clues that it's a switch (i.e. low or high series of addresses within a subnet, or all similar responses in the same [management] subnet). Basically this is the same kind of technique used by those looking to break into a network.
There are some common reasons why active probling won't help include: the managed switch is configured to act like a non-managed switch (this is unusual), the managed switch has been properly secured (not as common as it should be), or the managed switch is mis-configured for remote access (not too common).
