I have read a lot online how redirection by DNS works, could someone please tell me or point me in the right direction how a captive portal redirects unauthenticated users via IP and not DNS to provide the login page?
If you are captive, the network can do pretty much anything it wants with your connection attempts.
So if you choose to go to http://220.127.116.11/, the gateway can respond to those requests itself with a simple http redirect to the login page.
The gateway is not obliged to forward packets to IP addresses beyond itself.
The IP-based captive portals I've seen work by altering ("rewriting") the destination IP before passing the packet on; then, in cases where the captive portal is the same box as the router, the packet is passed to the internal interface instead of the WAN side.
On the way back to the captive machine (ie. client), the source IP is rewritten, so the captive machine thinks it's talking to its original destination. Search online for DNAT if you want to know more.
Side note - it works nicely for HTTP, but causes mayhem for other apps such as IM.
A cleaner solution would be to operate above the IP layer: use a transparent HTTP proxy which issues 301s to captive machines, combined with dropping all non-HTTP traffic coming from captive machines, but the user has to use a browser to give their credit card details (or whatever releases them from being captive.)