Monitor DNS for device identification.
Here are some popular DNS domains for time
*.pool.ntp.org time.google.com time.apple.com time.android.com api.rokutime.com time.cloudflare.com time.windows.com time.nist.gov
A bigger list: gist.github.com/mutin-sa/eea1c396b1e610a2da1e5550d94b0453
Could intercept and redirect to local ntp as described here: forum.openwrt.org/t/redirect-outgoing-ntp-traffic-to-an-internal-ntp-server/161223/8
Here are some popular DNS domains for time
*.pool.ntp.org time.google.com time.apple.com time.android.com api.rokutime.com time.cloudflare.com time.windows.com time.nist.gov
A bigger list: gist.github.com/mutin-sa/eea1c396b1e610a2da1e5550d94b0453
Could intercept and redirect to local ntp as described here: forum.openwrt.org/t/redirect-outgoing-ntp-traffic-to-an-internal-ntp-server/161223/8