NTP probes may be rate limited(somewhat common) or intentionally delayed (not common) by middleboxes within the IP transport. One-way delays may vary with the NTP client's UDP source port. Actual application traffic can be sampled using GPS-sync'd packet captures.