Order Flow, Footprint
& Delta

1.1 Candles hide what happened inside

A candlestick shows four numbers for a period: the open, high, low and close. It tells you where price went. It does not tell you how it got there. Two candles can look identical while the trading inside them was very different.

A footprint chart (also called a cluster chart) opens each bar up. At every price inside the bar it shows how many contracts traded (a contract is one unit of a futures product). Each row has two numbers: the volume that traded at the bid (the highest price a buyer is currently willing to pay) on the left, and the volume that traded at the ask (the lowest price a seller is currently willing to accept) on the right. The result looks like a small spreadsheet drawn inside each bar.

The study of this buying and selling is called order flow. It is a way to look at the activity behind price. It is context for your own decisions. It is not a prediction.

A simple example: a broker's screen shows 'ES 5,000.00 x 5,000.25'. The bid is 5,000.00 and the ask is 5,000.25, so the spread is one tick. If you send a market buy order, you pay 5,000.25 and print as ask volume. If you instead place a limit buy at 5,000.00, you wait. You only get filled if someone sends a market sell. Your order is passive until then, and the person who sells to you is the aggressor.

1.2 What you need before you can see one

Footprint data requires a platform and a data feed that record bid/ask tick data. A tick here means one individual trade print, tagged with whether it traded at the bid or the ask. (Do not confuse it with a price tick, the smallest price step. On ES that step is 0.25 points.) Ordinary free charts only record open, high, low, close and total volume, so they cannot draw a footprint.

Examples of platforms that offer footprint or order flow charts include Sierra Chart, ATAS, NinjaTrader with its Order Flow+ add-on, and TradingView's footprint chart on some paid plans. These are examples only, not endorsements. Features, prices and data fees change, so check the current details yourself. Real-time futures data usually carries an exchange data fee as well.

Every footprint in this guide is an illustrative example with invented numbers, because we do not have tick data to publish. The numbers are built to be internally consistent so you can practise the arithmetic. They are not real market prints.

Aggressor flags come from the exchange's trade messages, so the classification is not a guess about intent. It is a record of which side crossed the spread. That is a useful fact, but a narrow one. It does not say whether the aggressor was opening a new position, closing an old one, or hedging something else.

1.3 The parts of one footprint bar

Look at the example below. Prices run down the middle of the bar, highest at the top. For each row, the left number is bid volume and the right number is ask volume.

In the example, the bar traded 320 contracts at the bid and 356 at the ask. The busiest row is 5,000.25, with 95 + 110 = 205 contracts. Ask volume was a little larger than bid volume overall, so the bar's delta is 356 - 320 = +36.

Think about size too. On a heavily traded product such as ES, a few hundred contracts can pass through in a single second at busy times. A row with 20 contracts on a quiet afternoon means something very different from 20 contracts at the open. Always judge numbers against what is normal for that time of day on that market, rather than against a fixed figure.

1.4 How to read a footprint bar

1. Find the high and low of the bar and see how much volume traded near each end.
2. Find the busiest row. This shows where most trade happened inside the bar.
3. Compare bid and ask in each row. Is one side much larger than the other?
4. Add up both sides and subtract to get the bar delta.
5. Ask: did the volume pattern match what price did? If price rose, was buying visibly active?

Do not worry about memorising patterns yet. Lessons 2 to 6 build one idea at a time. For now, the main skill is simply reading the grid without feeling lost.

2.1 Two sides to every trade

Every futures trade has exactly one buyer and one seller. So why do footprints split volume into bid and ask? Because one of those two people chose to cross the gap between the best buy price and the best sell price. That gap is called the spread.

The person who crosses the spread is the aggressor. They use a market order, which says 'fill me now at the best available price'. The person who was already waiting is the passive side. They used a limit order, which says 'fill me at this price or better, and I will wait'. Limit orders waiting in the book are what create the bid and the ask in the first place.

Think of bar delta as a net score. Suppose the bar's ask total is 356 and its bid total is 320. Delta is +36. If the next bar has ask 300 and bid 410, delta is -110. You are not predicting anything yet. You are only recording which side was more aggressive in each period, one bar at a time.

2.2 How the footprint labels it

When a market buy order hits a resting sell order at the ask, the trade prints as ask volume. The buyer was the aggressor and the seller was passive. When a market sell order hits a resting buy order at the bid, it prints as bid volume. The seller was the aggressor and the buyer was passive.

This is why 'bid' and 'ask' volume in a footprint are really measures of aggressive selling and aggressive buying. Futures exchanges send trade data that identifies which side was the aggressor, and footprint software uses that flag.

Bar A's delta is +262 and Bar B's is -262, because the numbers are mirrored. In both bars the busiest row is the same price, 5,001.50. The difference is which side was in a hurry at that price.

A key point: delta is also affected by bar size. A 1-minute bar and a 15-minute bar can have the same delta number but mean different things, because the longer bar contains far more volume. Compare like with like, and keep your timeframe constant while you learn.

2.3 Why 'more ask volume' does not equal 'bullish'

It is tempting to say: heavy ask volume means buyers are strong, so price must go up. That is too simple. Remember that each aggressive buyer needed a passive seller to trade with. If a large passive seller keeps absorbing the aggressive buying, price may go nowhere. Lesson 5 covers this in detail.

Also, volume counts contracts, not people. One participant can send hundreds of contracts in seconds, and we cannot tell from anonymous data who it was. So we describe what was consistent with buying or selling pressure, not what 'big players' did.

The useful question is not 'who bought?' but 'which side was more aggressive, and did price respond?' If aggressive buying appears and price rises, the two agree. If aggressive buying appears and price does not move, that disagreement is worth noticing.

One more check is the relationship between delta and the close. A bar that closes near its high with positive delta is simple to describe. A bar that closes near its high with negative delta is more interesting, because it raises a question rather than answering one. Questions are fine. Treat them as notes to follow up, and wait for the next bars to give more information before drawing any conclusion.

3.1 What delta is

Delta is the difference between aggressive buying and aggressive selling in a period. The formula never changes: delta = ask volume - bid volume. A positive delta means buyers were more aggressive. A negative delta means sellers were more aggressive.

Delta is calculated for each bar by adding all the ask volume, adding all the bid volume, and subtracting. You can also see delta for each row, but bar delta is the number most traders look at first.

Delta only measures aggression. It does not measure everything. Passive orders that were not hit do not appear in it at all.

Notice how the same shapes appear again and again. A bar with a small body but huge volume often hides a fight: lots of aggression, very little progress. The delta may even be lopsided and still tell you little about direction until you see what price does next. That is why delta is always read with price, never alone.

3.2 Two up bars, two different stories

Both bars below close higher than they open. A candlestick trader would say they look similar. Their footprints tell different stories.

Bar 1 has delta +175. Aggressive buyers were active and price rose. Bar 2 has delta -92. Sellers were more aggressive, yet price still closed higher. Something on the other side absorbed their selling, such as passive buyers waiting at the bid. That is one possible reading. Another is short covering, where traders who sold earlier buy back to close. We cannot tell from the numbers which it was.

Also compare each bar with the one before. If delta has been positive for five bars and then turns sharply negative while price is still near the high, that change in behaviour is more informative than any single number. Changes in behaviour are often more useful to study than absolute levels.

3.3 The four scenarios

Two of the four are agreement: the market moved the way the aggressive side pushed. Two are disagreement: price moved against the aggressive side. Disagreement is not a trade signal by itself. It is a prompt to ask why, and to look at where on the chart it happened.

Context matters. Disagreement at a level you already marked (for example the prior day's value area edge from Supplement 1) is more interesting than disagreement in the middle of nowhere. Even then, it is context for a decision, not a prediction of what comes next.

A short routine helps: (1) read the delta number, (2) check whether price agreed, (3) note the location on the chart, (4) write down what would make the reading wrong. Four lines in a notebook beat a dozen indicators on screen. Over a few weeks you will see which readings were useful and which were noise, and you will have records rather than memories.

4.1 Adding up the deltas

Cumulative delta (often written CVD) is a running total of bar delta. Start at zero at some starting point, usually the start of the session. Add each new bar's delta. Positive delta lifts the line; negative delta pulls it down.

The result is a line that shows the net direction of aggression since the starting point. Because it depends on that starting point, always check where your platform resets it (for example at the session open). Two charts with different resets show different lines.

Different platforms may show CVD as a line, as candles, or as an oscillator that resets each bar. These are the same data drawn differently. Make sure you know which version you are looking at, and keep the same one while you practise so that readings stay comparable from day to day.

4.2 What a divergence is

A divergence happens when price and an indicator move in different directions. With CVD, the classic example is price making a higher high while CVD makes a lower high. In the three bars above, price made new highs each time, yet CVD peaked at 95 on Bar 2 and fell to 32 on Bar 3.

The same idea works in reverse: price makes a lower low while CVD makes a higher low. The meaning is consistent with the move losing support from aggressive participants. It could mean passive orders are absorbing the move, or that the move is simply running out of interest.

Divergences are also easy to over-see. If you look hard enough you can find a divergence on almost any chart, because two noisy lines will often point in different directions over short windows. To keep yourself honest, write down in advance what counts: for example 'two consecutive swing highs on the 5-minute chart, at least ten bars apart'. Fixed definitions stop you from fitting the pattern after the fact.

4.3 Why divergences can fail

A divergence describes the past and the present. It does not say when, or whether, price will turn. Strong trends can show divergences for a long time while price keeps going. Also, CVD can be distorted by one large order, by the choice of reset point, and by contract rolls.

So treat a divergence as one piece of context. Questions to ask: Is it happening at a level I already marked? Did price stall afterwards, or keep going? What would show me I am wrong? Always decide where you would be wrong before looking for any other confirmation.

Finally, remember what CVD cannot tell you. It cannot tell you about orders that never traded, such as large resting limit orders that were cancelled. It cannot tell you who is on the other side. And it cannot tell you the future. What it can do is give you an organised record of aggression, which you can compare with what price did.

5.1 Two ideas that are often mixed up

Traders often use the words absorption and exhaustion as if they meant the same thing. They do not. They describe two different volume patterns.

These two ideas are often mixed up because both can appear at the same kind of place: a prior high, a prior low or a value area edge from Supplement 1. The difference is in the volume, not the location. Training your eye to ask 'heavy or thin?' first prevents most of the confusion.

5.2 Absorption: heavy volume, no progress

Absorption means a large amount of aggressive volume trades at a price, but price does not move through it. For absorption to happen, passive orders on the other side must be big enough to soak up the aggression.

Here sellers were aggressive: delta is -190 on the bar, and 340 contracts traded at the bid on the lowest row. Yet price stopped at 4,998.00. That is consistent with passive buying absorbing the selling at that price. We cannot know who the buyer was, only that price did not progress.

What would show the absorption has failed? If price trades below 4,998.00 and keeps going, the passive buyers have either stopped or been overwhelmed. A trader who studies this pattern should therefore note a level where the idea is wrong in advance, for example a few ticks beyond the absorbed low. If you do not know where you are wrong, you do not have an idea; you have a hope.

5.3 Exhaustion: volume drying up at the extreme

Exhaustion looks different. Price pushes to a new high or low, but the volume at the very tip is thin. Buyers (or sellers) have stopped showing up, so the move ends on a 'thin tip' with little trading behind it.

Notice that the top two rows hold only 4 + 3 and 6 + 8 contracts, compared with 55 + 140 = 195 at 5,005.00. The thin tip is a warning that few participants wanted to trade at those higher prices. It does not say price must reverse; only that the move may be losing support.

A related caution: a thin tip can also just be the end of a quiet bar. Thin volume is only informative when it happens after an obvious push, near a level you already care about, and at a time of day when volume is normally decent. A thin tip at lunchtime tells you much less than the same tip near the open.

5.4 Telling them apart

Ask two questions. First, how much volume is at the extreme? Heavy suggests absorption; thin suggests exhaustion. Second, did price make progress? Absorption has none despite the effort; exhaustion has some, ending on a poke. Both are descriptions of what has happened. Neither tells you what the next bar will do, so each still needs a defined risk if you decide to act.

The table in section 5.1 can be copied into your notes as a quick checklist. When you review a day, tag each candidate bar as absorption, exhaustion or neither. Neither is a perfectly good answer, and most bars will be neither. Counting how often a pattern appears, and what price did next, is how you learn its real value for your own style.

6.1 The diagonal rule

An imbalance is a price where one side traded far more than the other. The correct comparison is diagonal, not across the same row. This is because the ask at a price is matched against the bid one tick below it: when buyers lift the offer at P, the bid they stepped over sits at P - 1 tick.

The 3x (300%) setting is a common default in software, not a rule. Some traders use 2x or 4x, and many add a minimum size so tiny numbers do not count. It is a setting to experiment with.

Why diagonal? When a buyer lifts the offer at P, the best bid at that moment is one tick lower. The imbalance test asks: did buyers at P overwhelm the sellers who had been waiting one tick below? Comparing the bid and ask on the same row would mix two different groups of people, since the bid at P was never in the way of buyers who paid P.

6.2 A worked example

Four consecutive rows all flag as ask imbalances. This is called a stacked imbalance: several adjacent price levels where the same side dominated. Many traders define 'stacked' as three or more in a row.

The bar's delta is +256. Aggressive buying was strong at every price from 5,011.25 to 5,012.00. It is a picture of one-sided aggression, and some traders watch stacked areas as potential reference zones to revisit later.

To check the 'stacked' rows by hand, start at the bottom flagged row and work upward. Each row uses its own ask and the bid one row below it: 100 against 30, then 90 against 28, then 66 against 22, then 70 against 15. All four ratios are at least 3, so the stack runs four rows tall. The bottom row, 5,011.00, has ask 45 against bid 50 below it, so it does not flag, and the stack stops there.

6.3 When imbalances do not mean much

A single imbalance, like the one below, is common and often meaningless. On quiet, thin rows the ratio test is easy to pass with small numbers.

Stacked imbalances can also fail. Aggression can be followed by price giving back the whole move. They are a description of what happened in one bar. Whether price revisits, respects or ignores that area is something you can only find by watching, which is why this is practice material and not a forecast.

A good habit is to log the stacked imbalances you notice and watch whether price later returned to them. In some cases it will pause there, in some it will run straight through. Keep honest counts of both. If you only remember the cases that worked, your records will tell a nicer story than the market does.

1.1 What VWAP is

VWAP stands for volume-weighted average price. It is the average price traded since a starting point, where each price counts in proportion to the volume that traded there. In words: add up (price x volume) for every trade since the start, then divide by the total volume. A price with heavy volume pulls the average toward itself more than a price with light volume.

Most platforms start the calculation at the beginning of a session and let it run to the end. It resets the next session. Because it is cumulative, VWAP moves quickly early in the day and slowly later, when it carries many hours of history.

VWAP is a backward-looking average. It describes where trade has happened so far. It is a reference line that many traders watch, which is a reason it is worth knowing. It is not a forecast, and price is under no obligation to return to it.

A tiny example makes the formula concrete. Suppose 10 contracts trade at 5,000.00 and 30 contracts trade at 5,001.00. The VWAP is (5,000.00 x 10 + 5,001.00 x 30) / 40 = 200,030 / 40 = 5,000.75. The average sits closer to 5,001.00 because more volume traded there. A simple average of the two prices would be 5,000.50, so volume weighting matters.

1.2 Standard-deviation bands

A standard deviation (SD) is a measure of how spread out numbers are around an average. Platforms draw bands at plus and minus 1 SD, 2 SD and sometimes more around VWAP. A move to the +2 SD band means price has stretched far from the day's average price compared with the spread so far.

It is tempting to say the bands show where price is 'statistically unlikely' to go. That is not a safe reading. Market prices are not neatly bell-shaped, and bands widen and shift as the day goes on. Trend days can live beyond 2 SD, or ride along an outer band for hours. The bands describe stretch. They do not mark a limit.

1.3 Reversion days and trend days

Some days price stretches away from VWAP and then returns to it. Traders call these reversion days. Other days price moves away and stays on one side: trend days. The difficulty is that on the morning of a trend day, it can look just like the start of a reversion day.

Because you cannot tell in advance which type of day it will be, VWAP and its bands work best as context. Useful questions are: Is price above or below VWAP? Is VWAP sloping up or down? How far has price stretched, and has that stretch been growing or shrinking? If every pullback toward VWAP stops short and price turns away, the day is behaving like a trend day, and the idea of 'it must revert' deserves doubt.

A note on the settings: your platform may anchor VWAP to the regular session, or the full 23-hour session. Both are legitimate; they give different lines. Pick one and keep it so your notes stay comparable.

2.1 Choosing your own starting point

Session VWAP always starts at the session open. Anchored VWAP lets you pick the starting point yourself. From that point onward, the platform draws the volume-weighted average price since the anchor. The maths is exactly the same as in Lesson 1. Only the start changes.

That is all it is: the volume-weighted average price of every trade since the anchor. It is a tidy way to ask, 'Compared with the average price traded since that event, is the market now above or below?'

Because the line starts at the anchor, the early part of an anchored VWAP is very sensitive. With only a few bars of data it hugs price closely and moves around. As more volume accumulates, it settles and becomes slower. This is the same behaviour as session VWAP in the morning, and it is a reason to be careful about reading too much into a line that was anchored only a few bars ago.

2.2 Where traders anchor it

The choice of anchor changes the line. Two traders anchoring to different swing points will see two different lines on the same chart. That is not an error. It is a reminder that anchored VWAP is a tool shaped by your choice, so there is no single 'correct' line.

You can also use more than one anchored line at once. For example, one from a swing low and one from a swing high on the same chart. When price sits between the two, the chart shows a market that is above the average since the low and below the average since the high. That is a description of position, not a signal, and it shows why keeping the number of lines small helps you stay clear.

2.3 What it is not

You will often read that anchored VWAP is 'the institutional cost basis' or 'where big players are underwater'. Do not trust that wording. It is only the volume-weighted average price of trades since your anchor. It includes every participant who traded, on both sides, at every price. It does not tell you the cost of any individual or group.

Used honestly, anchored VWAP is a way to measure distance from an average that you chose, with a reason you can write down. 'I anchored to the swing low because it was the last major turning point' is a reason. 'I anchored where it made the chart look good' is not. Write the reason in your notes before you look at how price reacted.

Also keep in mind that anchored lines are not special. Price may respect one a dozen times and then trade through it. Treat each as a place to pay attention, plan your risk around it, and accept that sometimes nothing happens at all. Because anchored lines can be placed anywhere, it is easy to find one that 'worked' in hindsight. To avoid that trap, decide your anchors by rule before the session starts, such as the most recent major swing high or low, and stay with them for the day.

3.1 Liquidity and stop orders

Liquidity means how easily you can trade without moving the price much. Where there are many orders resting, liquidity is deep. Where there are few, price can jump.

A stop order is an order that becomes a market order once price reaches a chosen level. Traders use stops to limit loss. There are two kinds that matter here. A sell stop sits below the current price and sells when price falls to it. A buy stop sits above the current price and buys when price rises to it.

Now the key point about sides. A trader who is long (bought, hoping for a rise) places the protective stop below their entry. That is a sell stop. A trader who is short (sold, hoping for a fall) places the protective stop above their entry. That is a buy stop.

Why does this matter for learning? Because many popular ideas about 'where the stops are' are based on guesses about other traders' behaviour. The guesses can be reasonable. Prior highs and lows are visible to everyone, so traders often place orders relative to them. But a reasonable guess is still a guess. You will never see the order list. What you can see is what price did when it reached the level.

3.2 Where stops tend to sit

So the stops above a high are buy stops: they belong to short sellers protecting themselves and to breakout buyers. Long stops sit below lows. Equal highs, equal lows and round numbers draw attention from many traders, which is one reason some traders think orders may cluster there. We cannot see the orders. This is an inference about behaviour, not a reading of the book.

Round numbers add to this effect. Prices that end in 00 or 50 (for example a level like 7,800.00) attract attention because humans like round figures. Some traders place stops, targets and entries around them. That can make the area busier than nearby prices. Again, this describes where activity may happen, not which way price will go.

3.3 Stop runs, and when they are just breakouts

A stop run (or sweep) is a quick move beyond an obvious level that triggers stops, followed sometimes by a reversal. When the stops trigger, they turn into market orders, which adds buying or selling at that moment. If nobody is there to continue the move afterwards, price may snap back.

Do not assume every poke through a level is a stop run. Sometimes it is simply a breakout, and price keeps going. Telling them apart in real time is hard. One approach is to wait for evidence that the move was not accepted, such as price trading back inside the prior range and holding there. Even then, define your risk before acting. A sweep that does not reverse is a loss for anyone who assumed it would.

Also remember that stops can be a reason for a move to continue. A cascade of stops being hit pushes price further in the same direction. Stop-run language only makes sense after you see what price does next.

4.1 One central order book

You may have read about 'dark pools' where large traders hide their orders. Those exist for stocks and ETFs. ES and NQ futures are different. They trade on the CME exchange, which runs a single central order book. Standard orders for these contracts go into that book and are matched there.

So there is no dark pool for ES or NQ. Everything that trades in the central book is public in the sense that all participants with the right data subscription receive the same trade prints. What is hidden is not an extra venue. It is simply who placed each order and why.

This also means the order book on your screen, often called depth of market or DOM, shows only a part of the picture. Resting orders can be cancelled in an instant, and large orders are sometimes split into small displayed pieces. Because of this, experienced traders put more weight on what actually traded than on what was merely displayed.

4.2 Block trades and EFPs

The exchange does allow some large trades to be agreed privately and then reported. Two types are worth knowing.

These trades do not behave like normal orders. They do not walk up the book and they are not visible in the depth of market before they happen. They matter mainly because they show that not all large business appears as aggressive prints in the footprint.

If you see a large print on a tape, do not conclude it is an 'institution'. A single large print can be one order, an algorithm slicing a large order, or two traders matching. Anonymous data does not say which. The honest wording is 'a large print was consistent with larger participants'.

A useful habit is to separate the three layers of any observation. Layer one is the fact: 'about 800 contracts traded at the ask in ten seconds'. Layer two is the description: 'aggressive buying'. Layer three is the story: 'a large buyer is accumulating'. Layers one and two come from the data. Layer three is your guess, and it is the most likely to be wrong. Keep the layers apart in your notes.

4.3 What you can and cannot see

This is a useful reality check. Order flow is a record of what traded and which side crossed the spread. It cannot name the participants. Anything beyond that is interpretation, and interpretation can be wrong. Write 'consistent with' and keep your risk defined.

None of this makes order flow useless. A record of what traded is valuable, and so is knowing exactly how limited it is. Traders who respect those limits tend to describe patterns more cautiously, size their risk without assuming they know who is on the other side, and are less likely to be misled by a confident-sounding story about 'smart money'.