# What are the "sniffing" or "stalking" algorithms?

I was looking for all the sorts of trading algorithms used in stock market and I came across the so-called "sniffing" algorithms. However, the explanations of this concept I found are very poor and ambiguous.

The first explanation states:

• It is a kind of algorithm that searches for another trading algorithms.

The second explanation states:

• It is a kind of algorithm that detects whenever "smart money" made the transactions.

So here my questions to you:

1. What is a sniffing algorithm?
1. How does the algorithm that searches another algorithms look like? Does it use some tools such decomposition of signals?
1. How to estimate the ratio of transactions made by big institutes and total volume in given day?

Thank you for any help.

• Mkultra, does the below answer your question, or there's still some stuff that you'd like to clarify? Mar 5, 2021 at 8:36
• Everything is fine, although i was waiting for some references, that includes some code. Nevertheless i accept this answer. Mar 5, 2021 at 10:41
• I see. Most types of trading algos are proprietary, so quite unlikely that someone would be able to post an actual code here (especially code measuring latency, etc). But if you find code for latency-measuring somewhere else and combine it with the logic described below, it should be a decent start if you want to go down this path... Mar 5, 2021 at 11:22

## 1 Answer

Sniffing (or stalking) algo indeed detects other algorithms. How does that work in practice?

Imagine the order book for a particular equity is: Bid 1 = 99 (size 10,000), Bid 2 = 98 (size 25,000), Bid 3 = 97 (size 30,000), Offer 1 = 101 (size 10,000), Offer 2 = 102 (size 25,000), Offer 3 = 103 (size 30,000).

So in the example above, the bids and offers are perfectly symmetrical and the price is in perfect equilibrium (mid = 100).

Imagine someone hits the bid at 99, in size 8,000, and within a split second, someone else takes the remaining 2,000 bid at 99. This type of behavior is "momentum trading", and the algo's strategy here is to "hit the remaining quotes, whenever another market participant takes more than 50% of a specific quote".

There will be multiple algos at play at any point in time, and they are all capable of measuring each other's response time and behavior patterns: so for example, another algo would be able to see that the first algo responded within a certain (very small) time frame and took out the remaining size, and it would identify the first algo as "stalker".

The first algo would almost certainly NOT be a market-making algo, because market-makers try NOT to move the price when they trade: imagine a different scenario, when someone hits the bid at 99 but only in size 1,000: this will immediately mean that the last traded price of the equity is no longer 100, but rather 99. A market-making algo who is carrying out a "sell" execution would quite possibly hit the 99 in size 8,000, but wouldn't take out the whole price, not to move the price lower away from 99.

Last but not least, all algos try to keep a "record" of other algo's positions: so once someone has identified the first algo as "stalker" and identified its latency time in which it took out the bid at 99, it will try to keep a track of its position throughout each day (and the latency response time will be one way they can do that, i.e. comparing response time vs. other algos). It's not 100% reliable, but the accuracy can be high.

Hopefully the above helps a bit to paint the picture...

• Very interesting Jan. Qn. "Last but not least, all algos try to keep a "record" of other algo's positions" how is this possible from an order book perspective? How are these algos able to see who/where the orders came from? Feb 24, 2021 at 11:19
• @Sledge81: it is not 100% accurate as I alluded to, but once the first algo was identified as a "stalker" and matched with a certain latency time, whenever another quote is "taken out" once it was first "hit" by someone, and the algo that took out the remainder of that quote displays the same exact latency as the the first time, it would be recorded under that "first algo". Again, to stress, this is not 100% accurate rocket science, just something I would describe as "trying to make sense of the actions in the order book". Feb 24, 2021 at 11:30
• From a practical prospective, to detect the presence of trading algos and their parameters you need to analyze the full order log, preferably with visible IOC orders. Precision needs to be least microseconds. There you can look for order sequences and latency patterns. The patterns are somewhat easier to discover when liquidity is low as it makes algos stand out. Feb 25, 2021 at 9:00