(S)NTP servers usually run on UDP port 123.
NTP packets are always 48 bytes long.
l7-filter uses the ntp pattern. NTP packets are purely binary data and contain very little identifying information. Therefore, in order for the l7-filter pattern to reliably match NTP, the pattern had to be written in such a way that it sometimes also matches random traffic from other binary protocols. Be cautious when using this pattern.