If you try to see the network statistics [request / response], you will find that devices such as ios and android, both of them constantly get to some special URLs [in the case of android it is www.google.com/generate_204 , do not remember exact url for ios]. These URLs are generated internally by the system. These messages let their server know about various details. Thus, as soon as ios connects to an unclaimed portal, it tries to get to the system generated URL, as a result of which it realizes that it is network protected at the packet level and opens the browser.
Hope this helps.
source share