WINRM authentication

Team,
I connected a remote PC using WINRM. Using Enter-PSSession -cn . Also seen netmon trace & found only SNTP, TCP & HTTP traffic. Can you pls explain how authecation is worked there using those three Protocol? No kerberos/ntlm found. Even I used ISE New remote powershell tab & result is same . Only found SNTP, TCP & HTTP traffic