We can get connected to those public WiFi hotspot without the account but can access to no website but the login page. As I tested, all those login website would respond to my ping even I was an unauthorized user. I wonder if there are some any restrictions that forbid the captive portal system to block the ICMP echo packet, or blocking it can cause any serious problem . After all the echo packet is the main cause of DDos attack , it should be blocked if there is no necessity for them.
On the one hand, as it has been stated, I think that the DDoS risk is definitely not the reason why you should block ICMP.
On the other hand, if ICMP or DNS is allowed, you can open a tunnel with a remote host over this protocol and totally bypass the captive portal. If those protocols are not blocked (or at the very least monitored), you basically have free access. There are tons of tools to do that even on the wikipedia page about ICMP tunneling..
Those protocols are usually not blocked because of negligence, they should be.
I don't know where to you get the information about ICMP as the main cause of DDoS (I really doubt it), but
- There must be a way for the client to access the capture portal, because otherwise login would not be possible. Which means that the client can send data to the capture portal and that these data gets processed there. In this case it does not matter if ICMP is blocked, because the client might still mount a TCP based attack against the server on the capture portal.
- There are usually not much clients behind a capture portal (compared to the number of the system on the internet) so the "distributed" DoS is not very effective anyway.