when logged in GUI the sniff traces are attached below

You need to show us the sniff results on the failing attempt, not when it works.

Start the trace, then make the attempt to log in to the system. That will probably tell you (in comparison to the successful login) where the failure occurred.