Pinging & sniffing

Sending small orders to detect hidden liquidity or large resting interest. The grey zone of information-gathering, covered so you can recognise it being done to your orders.

The idea

What are pinging and sniffing, exactly?

Pinging is placing small orders (often immediate-or-cancel) to test for non-displayed liquidity: iceberg remainders, hidden orders, or dark-pool size. If the probe is absorbed without the visible book changing, hidden size is present; if it rests untouched, there is none. Sniffing is the wider inference of latent liquidity and counterparty behaviour from how the market responds to your and others' actions. Both are about detecting size that the book does not show.

Not all liquidity is displayed. An iceberg order shows only a small "tip" while a large remainder rests hidden; hidden and dark-pool orders show nothing at all. A trader who wants to know whether real depth is there can send a small order: if it fills without the displayed quote moving, there is hidden size behind the tip. That is pinging. The mechanics are the same as legitimate order-type behaviour, which is exactly why this page is about the line, not the technique. The interactive mechanics of hidden versus displayed liquidity live on the order-types page; here the subject is legality.

The grey zone: where does the line actually sit?

There is no statute named "pinging": its legality depends on intent and effect. Probing to find liquidity so you can execute better is generally legitimate, normal best-execution behaviour. It becomes prohibited when the probing is designed to create false or misleading signals, or to detect and then disadvantage other participants, for example to front-run the liquidity you found, or to use the information to manipulate. The conduct is judged under MAR Article 12's general tests, not a dedicated rule.

The honest map runs across a spectrum. At one end, probing to discover whether real depth exists so you can size and route your own order better is legitimate. Systematic cross-venue probing to map liquidity for your execution is legitimate but watched: fine if genuine, provided it respects order-to-trade-ratio limits and does not tip into quote-stuffing-shaped traffic. Probing whose primary purpose is to extract information about others' resting size, with ambiguous benefit to your own execution, is grey: context-dependent, turning on intent and effect. And probing designed to create false signals, or to detect liquidity and then act against the counterparty, is prohibited as market manipulation.

The crucial honesty: most pinging is legal. What this section exists to do is mark the edge (the point where probing stops being about your execution and becomes about deceiving or disadvantaging others) and to be clear that the edge is defined by intent and effect, not by the probe orders themselves.

Why is the abusive form illegal?

When probing is designed to create a false impression of liquidity, or to detect a counterparty's hidden size and then trade to disadvantage them, it falls under MAR Article 12(1)(a)/(c) (orders giving false or misleading signals, or deception and fictitious devices) where the probing has no legitimate execution reason. The harm is informational: it degrades the protection non-displayed orders are meant to provide.

No rule names "pinging", so the EU/UK route is through MAR's general manipulation tests. In the US, the SEC has taken significant dark-pool enforcement actions concerning the misuse of information about resting (including pinged) liquidity, and inadequate disclosure of how participants could detect it, pursued under §10(b)/Rule 10b-5 and the venue-disclosure rules, rather than a "pinging statute". The pattern across both regimes is the same: the technique is not banned; the abusive purpose and effect is. That is why intent and the use made of the detected information are decisive. See the market-abuse regimes for how the general tests apply.

How is abusive pinging detected?

Because the technique is shared with legitimate execution, detection focuses on what the probing is for. Surveillance looks for systematic small probe orders (often immediate-or-cancel, often cancelled) that are correlated with subsequent adverse action against the detected liquidity, rather than with the prober completing its own genuine execution. The probe itself is ambiguous; the use made of the information is not.

Five signals combine. Probe-then-act correlation: small probes immediately followed by orders that exploit the detected counterparty, not by the prober's own fills. No genuine execution benefit: the probing does not plausibly improve the prober's own fills; its only value is information about others. Targeting of non-displayed liquidity: activity concentrated on revealing iceberg, hidden, or dark size, then acting against it. IOC / fleeting-order patterns: a high rate of immediate-or-cancel probes whose only function is detection. And cross-venue information use: liquidity detected in one venue used to disadvantage the same counterparty elsewhere. The difficulty mirrors momentum ignition: the probe is ambiguous, so the case is built from the use made of the information plus intent evidence, reconstructed from the order record and machine-learning surveillance.

How do you stay on the legitimate side?

If you probe for liquidity, keep it genuinely tied to your own execution: the information you gather should improve how you size, route, and time your orders, not be used to act against the counterparty whose size you detected. Respect order-to-trade-ratio limits so the probing does not tip into quote-stuffing-shaped traffic, and document the execution rationale.

The honest takeaway for a legitimate quant: liquidity detection is a normal, defensible part of execution and routing. Do it for your own best execution and you are in the legitimate region. The line you must not cross is using the detected information to deceive the market or to systematically disadvantage the participant whose hidden liquidity you found. The probe order is the same on either side of the line; what differs is what comes next and why.

Worked example

A synthetic walkthrough contrasting the two sides, as of 2026: recognition, not a recipe. The displayed best offer shows 5 lots at 100.01, but an iceberg is resting with a hidden remainder. A trader sends a small 2-lot immediate-or-cancel buy at 100.01. It fills, and the displayed 5 lots barely change, revealing hidden depth behind the tip. From here the two paths diverge entirely on purpose.

The legitimate path. The trader genuinely needs to buy 200 lots. Knowing real depth exists at 100.01, it routes its parent order there with confidence, achieving a better fill than blindly sweeping. The probe served its own execution. No manipulation: the probe is followed by the prober's own genuine execution at improved terms.

The abusive path. The trader has no genuine need to buy size. Having detected the resting iceberg, it instead places orders designed to trigger or disadvantage that counterparty, using the information to front-run the iceberg or to create a false signal against it. The probe served deception against another participant. The probe is followed by action against the detected counterparty with no genuine execution benefit to the prober: the probe-then-act-against signature.

The lesson: the same probe order is legitimate or abusive depending entirely on what comes next and why, which is why this is a grey zone judged on intent and effect, not on the probe itself. The figures are synthetic and illustrative; a real assessment rests on the order record and the use made of the information. See market manipulation for where this sits among the related conduct, and the market-abuse regimes for where the grey line is judged.