Anyone use WireShark? I'm trying to decipher what Winstep is trying to send out to check weather and check time.

While I'm not privy to the source code, I do believe the URLs for the weather are actually visible in the advanced settings, while the NTP protocol for communication with time servers is public domain.
I don't know what you're trying to "decipher" there... it's all plain data requests.

1. What are the names for %1 through %5

2. What about the format for the Time Request

%1 to %5 are just place holders for variable arguments such as location, units, etc...

I gathered that. More specifically What variable is %1, etc, etc.

Query Parameter Usage

cc Current Conditions
OPTIONAL
VALUE IGNORED

dayf Multi-day forecast information for some or all forecast elements
OPTIONAL
VALUE = [ 1..10 ]

link Links for weather.com pages
OPTIONAL
VALUE = xoap

par Application developers Id assigned to you
REQUIRED
VALUE = {partner id}

prod The XML Server product code
REQUIRED
VALUE = xoap

key The license key assigned to you
REQUIRED
VALUE = {license key}

unit Set of units. Standard or Metric
OPTIONAL
VALUES = [ s | m ]
DEFAULT = s

THANKS!!!!