de0u That said, NTP traffic is not particularly threatening in general.
Well, PCAPDroid shows "NTP" because the port used is 123. Granted the requests are to pool.ntp.org but one must be cautious in plainly assuming the traffic is DNS if on port 53 / NTP if on port 123 / HTTPS if on port 443 and so on...