According to the result monitored by fiddler, there are totally 3 handshakes for integrated windows authentication for IE.
WWW-Authenticate: Negotiate, NTLM
Authorization: Negotiate UYTYGHGYKHKJPPP-===
WWW-Authenticate: Negotiate UYUGKJKJKJ+++766==
Authorization: Negotiate HJGKJLJLJ+++===
WWW-Authenticate: Negotiate UHLKJKJKJJLK===
Who knows what concrete things are done for the three, especially the 2nd one.
P.S. The network environment is work group mode, other than domain mode, and the server is a website hosted on my local PC. In other words, the client (IE) & the server are both in the same machine.