gistfile1.txt

Sample of SNTP traffic, source networks:

sprint 4.0%
verizon-wireless 3.4%
tmobile 2.9%
att-wireless 2.8%
comcast 2.1%
orange 1.8%
sky 1.6%
twc 1.0%
att 1.0%
swisscom 0.9%
saudinet 0.8%
virgin 0.6%
opaltelecom 0.5%
qwest 0.5%
eli 0.2%
verizon 0.2%

Example Request matching this pattern.  All the above requests had the following settings in their NTP client request:
stratum=0, poll=4, precision=-6, root delay=1, root dispersion=1, reference timestamp=0, originator timestamp=0, 
receive timestamp=0

Traffic matching the above pattern accounted for 51.5% of the SNTP traffic and 47.0% of all traffic in this sample

12:41:46.675844 IP (tos 0x48, ttl 43, id 31770, offset 0, flags [none], proto UDP (17), length 76)
    x.x.x.x.20993 > x.x.x.x.ntp: [udp sum ok] NTPv4, length 48
        Client, Leap indicator:  (0), Stratum 0 (unspecified), poll 4s, precision -6
        Root Delay: 1.000000, Root dispersion: 1.000000, Reference-ID: (unspec)
          Reference Timestamp:  0.000000000
          Originator Timestamp: 0.000000000
          Receive Timestamp:    0.000000000
          Transmit Timestamp:   3690816106.510558999 (2016/12/15 12:41:46)
            Originator - Receive Timestamp:  0.000000000
            Originator - Transmit Timestamp: 3690816106.510558999 (2016/12/15 12:41:46)