On Nougat it seems to work flawlessly most of the time. I wonder what the protocol is. Maybe a request to the access point's DNS server to see what IP is returned and then connect to that?