clembo,
We use HTTP for the captive portal redirect.
There is nothing else on the table besides DNS lookup. Below is a typical output from an Anroid phone:
207.172.11.15 and 207.172.11.16 are the DNS servers
show datapath session table 192.168.210.203
Datapath Session Table Entries
------------------------------
Flags: F - fast age, S - src NAT, N - dest NAT
D - deny, R - redirect, Y - no syn
H - high prio, P - set prio, T - set ToS
C - client, M - mirror, V - VOIP
Q - Real-Time Quality analysis
I - Deep inspect, U - Locally destined
E - Media Deep Inspect, G - media signal
u - User Index
Source IP Destination IP Prot SPort DPort Cntr Prio ToS Age Destination TAge UsrIdx UsrVer Flags
-------------- -------------- ---- ----- ----- ---- ---- --- --- ----------- ---- ------ ------ -----
207.172.11.16 192.168.210.203 17 53 28434 1/4 0 96 0 tunnel 2617 4 0 0 FYI
0/0 0 0 0 local
207.172.11.15 192.168.210.203 17 53 30412 1/4 0 96 1 tunnel 2617 16 0 0 FYI
0/0 0 0 0 local
207.172.11.15 192.168.210.203 17 53 2408 1/4 0 96 1 tunnel 2617 16 0 0 FYI
0/0 0 0 0 local
207.172.11.15 192.168.210.203 17 53 1699 1/4 0 96 1 tunnel 2617 13 0 0 FYI
0/0 0 0 0 local
207.172.11.16 192.168.210.203 17 53 7799 1/4 0 96 1 tunnel 2617 11 0 0 FYI
0/0 0 0 0 local
207.172.11.16 192.168.210.203 17 53 55661 1/4 0 96 1 tunnel 2617 e 0 0 FYI
0/0 0 0 0 local
207.172.11.15 192.168.210.203 17 53 54624 1/4 0 96 1 tunnel 2617 9 0 0 FYI
0/0 0 0 0 local
207.172.11.16 192.168.210.203 17 53 35976 1/4 0 96 1 tunnel 2617 11 0 0 FYI
0/0 0 0 0 local
207.172.11.15 192.168.210.203 17 53 38106 1/4 0 96 1 tunnel 2617 2 0 0 FYI
0/0 0 0 0 local
207.172.11.16 192.168.210.203 17 53 47276 1/4 0 96 1 tunnel 2617 e 0 0 FYI
0/0 0 0 0 local
207.172.11.15 192.168.210.203 17 53 45076 1/4 0 96 2 tunnel 2617 13 0 0 FYI
0/0 0 0 0 local
192.168.210.203 207.172.11.15 17 30412 53 1/2 0 96 1 tunnel 2617 16 418 d0bf FCI
0/0 0 0 0 local
192.168.210.203 207.172.11.16 17 28434 53 1/2 0 96 1 tunnel 2617 4 418 d0bf FCI
0/0 0 0 0 local
192.168.210.203 207.172.11.16 17 7799 53 1/2 0 96 0 tunnel 2617 11 418 d0bf FCI
0/0 0 0 0 local
192.168.210.203 207.172.11.15 17 1699 53 1/2 0 96 0 tunnel 2617 13 418 d0bf FCI
0/0 0 0 0 local