What are the "sniffing" or "stalking" algorithms?

I was looking for all the sorts of trading algorithms used in stock market and I came across the so-called "sniffing" algorithms. However, the explanations of this concept I found are very poor and ambiguous.

The first explanation states:

• It is a kind of algorithm that searches for another trading algorithms.

The second explanation states:

• It is a kind of algorithm that detects whenever "smart money" made the transactions.

So here my questions to you:

1. What is a sniffing algorithm?
1. How does the algorithm that searches another algorithms look like? Does it use some tools such decomposition of signals?
1. How to estimate the ratio of transactions made by big institutes and total volume in given day?

Thank you for any help.

• Mkultra, does the below answer your question, or there's still some stuff that you'd like to clarify? Commented Mar 5, 2021 at 8:36
• Everything is fine, although i was waiting for some references, that includes some code. Nevertheless i accept this answer. Commented Mar 5, 2021 at 10:41
• I see. Most types of trading algos are proprietary, so quite unlikely that someone would be able to post an actual code here (especially code measuring latency, etc). But if you find code for latency-measuring somewhere else and combine it with the logic described below, it should be a decent start if you want to go down this path... Commented Mar 5, 2021 at 11:22

Sniffing (or stalking) algo indeed detects other algorithms. How does that work in practice?

Imagine the order book for a particular equity is: Bid 1 = 99 (size 10,000), Bid 2 = 98 (size 25,000), Bid 3 = 97 (size 30,000), Offer 1 = 101 (size 10,000), Offer 2 = 102 (size 25,000), Offer 3 = 103 (size 30,000).

So in the example above, the bids and offers are perfectly symmetrical and the price is in perfect equilibrium (mid = 100).

Imagine someone hits the bid at 99, in size 8,000, and within a split second, someone else takes the remaining 2,000 bid at 99. This type of behavior is "momentum trading", and the algo's strategy here is to "hit the remaining quotes, whenever another market participant takes more than 50% of a specific quote".

There will be multiple algos at play at any point in time, and they are all capable of measuring each other's response time and behavior patterns: so for example, another algo would be able to see that the first algo responded within a certain (very small) time frame and took out the remaining size, and it would identify the first algo as "stalker".

The algo that took out the remaining 2,000 bid at price 99 would almost certainly NOT be a market-making algo, because market-makers try NOT to move the price when they trade (that's also why quite possible the algo that took out the initial 8,000 bid at price 99 would also not be a market-making algo, because that action also moved the price from 100 to 99).

Imagine a different scenario, when someone hits the bid at 99 but only in size 1,000: this will immediately mean that the last traded price of the equity is no longer 100, but rather 99. A market-making algo who is carrying out a "sell" execution would then quite possibly hit the 99 in size 8,000, but wouldn't take out the whole size at price 99, not to move the price lower away from 99.

When the price was 100 and no action was being taken, a market-making algo carrying out a sell exectution would probably patiently wait with some offers at 101, 102, etc: and only start hitting bids if it saw that other participants started hitting the bids as described above.

Last but not least, all algos try to keep a "record" of other algo's positions: so once someone has identified the first algo as "stalker" and identified its latency time in which it took out the bid at 99, it will try to keep a track of its position throughout each day (and the latency response time will be one way they can do that, i.e. comparing response time vs. other algos). It's not 100% reliable, but the accuracy can be high.

Hopefully the above helps a bit to paint the picture...

• Very interesting Jan. Qn. "Last but not least, all algos try to keep a "record" of other algo's positions" how is this possible from an order book perspective? How are these algos able to see who/where the orders came from? Commented Feb 24, 2021 at 11:19
• @Sledge81: it is not 100% accurate as I alluded to, but once the first algo was identified as a "stalker" and matched with a certain latency time, whenever another quote is "taken out" once it was first "hit" by someone, and the algo that took out the remainder of that quote displays the same exact latency as the the first time, it would be recorded under that "first algo". Again, to stress, this is not 100% accurate rocket science, just something I would describe as "trying to make sense of the actions in the order book". Commented Feb 24, 2021 at 11:30
• From a practical prospective, to detect the presence of trading algos and their parameters you need to analyze the full order log, preferably with visible IOC orders. Precision needs to be least microseconds. There you can look for order sequences and latency patterns. The patterns are somewhat easier to discover when liquidity is low as it makes algos stand out. Commented Feb 25, 2021 at 9:00
• Why is it important to MM algos that the price doesn't move? And why does the fact that someone else hit the bid make the MM more likely to hit it? Commented Aug 30, 2022 at 17:22
• @actinidia: if the MM algo is carrying out a sell-order, it wants to sell at the highest possible price to benefit the client on whose behalf it is executing. In fact, the MM algos get often remunerated in direct proportion to how "successfully" they carry out the order, which is often measured by how much they move the price whilst executing. Your second question: if someone else already hit the bid, the price was moved by someone else, so the MM algo tries to take advantage of that "new" price whilst it's still there in some size (rather than wait until the price decreases further). Commented Aug 30, 2022 at 17:47