The following filtering possibilities with NTP data have been observed so far:
[ ] Amplification factor not taken into account yet, though we do have the byte count of responses to help us here.
[ ] "stratum" value in NTP data might tell us how intentionally the server is designed to be used for public consumption. A value of 16 is unsynchronised (read: completely unreliable) and possibly unintentionally available.
The following filtering possibilities with NTP data have been observed so far: