A pulled wall can appear, attract attention and vanish within a few seconds, often less. An indicator that checks the book once per bar, or even once per second, will miss most of that. This article is about the real-time side of spoofing detection: what "real time" has to mean, what goes wrong when it does not, and how to test such a tool honestly.

Why bars are the wrong clock

Most chart indicators update when a bar closes or when a trade prints. Order book changes are different events. A large bid can be added and cancelled without a single trade printing in between. If your indicator only wakes up on trades or bar closes, the wall's whole life can happen while it is asleep.

A real-time book indicator has to react to every market depth update: every add, change and removal at every level it watches.

What event-driven detection looks like

Vantedge BookScope and BookPilot share a Level 2 signal engine that is driven by the timestamps of the events themselves. For the Pulled Wall scanner, that means:

  • A level is checked against the levels behind it whenever its size changes. At 2.2 times their average (the default), it becomes a tracked wall.
  • The wall's age is measured in event time, so "lived under 5 seconds", which adds 0.15 to the spoof probability, is precise.
  • Price coming within 2 ticks marks it as approached, worth another 0.20.
  • The moment 60% of its peak size disappears without trading, it is scored as a pull.

Because every step runs on event timestamps rather than the wall clock, a session replayed later produces the same results, which matters for testing.

Showing it fast enough to matter

Detecting a pull is only half of real time. A display has to make it obvious. BookScope uses an on-chart DOM ladder that flashes in the colour of the engine that fired, tracked-wall boxes with pull marks, signal markers and alerts. Even so, a human reaction to a flash takes far longer than the engine took to fire.

That gap is the main argument for automation. Vantedge BookPilot can act on the signal itself: above Fire Probability (0.6 by default), it fades the pulled wall with a limit order 1 tick behind the touch, cancelled after 3 seconds or if price runs 3 ticks away. Each scanner then rests for 5 seconds before it can fire again.

When real time breaks: stale data

The biggest real-time risk is not a slow indicator but a frozen feed. If depth updates stop, the book on screen looks calm and nothing is flagged, which is exactly wrong.

BookPilot handles this directly: it refuses to arm if no Level 2 update arrived in the last 5 seconds, and says so in the panel. If you see "cannot arm -- no Level 2 data in the last 5 s", your feed has no depth for that instrument or replay is paused. Check that the SuperDOM shows several levels.

Why you cannot backtest it the usual way

NinjaTrader's historical bars store trades, not the order book. A spoofing indicator has nothing to read on history, and a strategy built on it produces no trades in the Strategy Analyzer. That is expected, not a fault.

The substitute is Market Replay. Download replay data for ES or NQ (Tools > Historical Data > Load > Market Replay), which includes depth, and play the session back. The indicator then sees the book change event by event, as it would live.

Replay tips

  • Replay the same days after each setting change so results are comparable.
  • Avoid rewinding and jumping. In BookPilot, rewinds reset cooldowns and the hourly trade count, which distorts results.
  • Watch the Blocked line to see why signals did not become trades: not armed, outside hours, against the bias, the hourly limit, or Forecast Confirm.

Keeping expectations real

Speed lets an indicator see pulls that slower tools miss. It does not make a pull mean more than it does. Many pulled walls are ordinary order management, and no score can see intent or hidden size. The BookPilot user guide explains the score and its settings, and the comparison page covers when a footprint strategy without Level 2 might suit you better.

Reacting faster also means losing faster when the read is wrong, and futures leverage magnifies both. Put the tool through Market Replay and a stretch of SIM trading before it goes near an evaluation, funded or live account.