I know for sure, push notification can come through airport wifi (the ones that you need to log in), even when you are not logged in. It may be something to do with notification via IP address instead of hostname.

Can someone who has dived into the code on iOS/Darwin or Android/Linux kernel verify this?