1) I would like to learn more about how you investigate the background traffic of a captive portal? – Do you mean you want to sniff all the traffics?

2) can you try to manually access the captive portal IP from firefox after connecting to the network? does it load or what do you get?