Do you mean via this script - https://svn.nmap.org/nmap/scripts/clock-skew.nse , if so it looks like that's extracting time values from protocols above TCP such as HTTP etc? Please correct me, if I misunderstood what you meant.

This was the type of technique I was thinking of - https://murdoch.is/talks/eurobsdcon07hotornot.pdf