Reply To: WINRM authentication

Assuming your traces are complete, the authentication is probably in the packets you've listed as TCP. TCP is a transport-layer protocol that can carry just about any type of application traffic (including HTTP.)