Captive Portal Packets Dropped for Android Devices

Diagnosis

Whenever the Android device establishes a connection to the wifi network, it automatically tries to visit a particualr site and tries to get a file name "generate_204". If it fails to get this information, it will generate a exclamation symbol next to the wifi icon identifying there is no internet connectivity.

This is expected behavior and it is hard coded in the Android OS. The sites differ for different Android OS versions.

This is a code that is used to detect if there is a Captive Portal configured somewhere in the network, and it will prompt to redirect to use a browser to complete the CP authentication process.

See the link below for the codes used in Marshmallow , Lollipop and KitKat:

1. KitKat

http://androidxref.com/4.4.4_r1/xref/frameworks/base/core/java/android/net/CaptivePortalTracker.java

2. Lollipop http://androidxref.com/5.1.1_r6/xref/frameworks/base/packages/CaptivePortalLogin/src/com/android/captiveportallogin/CaptivePortalLoginActivity.java

3. MarshMallow http://androidxref.com/6.0.0_r1/xref/frameworks/base/packages/CaptivePortalLogin/src/com/android/captiveportallogin/CaptivePortalLoginActivity.java

See the example screenshots below:

This results in overburdening the captive portal service on the Palo Alto Networks firewall, the Palo Alto Networks firewall will wait for the request to timeout, and then post the login page to the user. The default timeout value configured in the Android OS is 10.000 milliseconds.