One FIX capture in. Verified byte by byte by the browser, then diagnosed, reconstructed, judged and read.
Paste the log, or drop the file in. A real FIX reader runs here, free and offline: it works out
the delimiter from the message itself, reads length-prefixed fields by byte count,
recomputes every BodyLength and CheckSum from the bytes,
tracks MsgSeqNum separately per direction, chains ClOrdID into orders,
walks the order state diagram and checks that CumQty + LeavesQty = OrderQty. Then
pick a lane.
The first example ships a saved model run for all four lanes, so you can see the whole thing — the session diagnosis, the order reconstruction, the execution read and the tape — without signing in and without spending a credit.
Nothing in this app concludes that anyone manipulated a market. The tape numbers are signature statistics that a firm's own calibrated alert logic consumes, and a high value is a normal day for some strategies. Nothing here is legal, compliance or investment advice.
Diagnose the session
Did the transport work?
Your past runs
Nothing yet. Runs are saved to your SkillSafe account, so they follow you to another browser.
How this reads a FIX log
A FIX message is a sequence of tag=value fields terminated by SOH, whose first three
fields must be 8=BeginString, 9=BodyLength and 35=MsgType
in that order and whose last field must be 10=CheckSum. BodyLength
counts the bytes between the delimiter that ends field 9 and the delimiter that begins field 10;
CheckSum is the sum of every byte up to that point modulo 256, printed as exactly
three digits. Both are recomputed here from the bytes and neither is trusted.
Four things make a naive split wrong, and all four are handled. The delimiter in a log is often
not SOH — engines and people render it as a pipe, as the two literal characters
^A, or as a semicolon — so it is detected per message from the character that
follows the BeginString value, and the message is normalised back to SOH before any arithmetic.
Some values legally contain the delimiter: RawData(96), Signature(89)
and the Encoded* fields are length-prefixed for exactly that reason, and the reader
takes the stated number of bytes rather than splitting. A log line is not a message —
prefixes and multi-message lines are both normal — so the scanner finds the
8=FIX boundaries itself. And a tag may repeat, so every occurrence is kept in order
and repeating-group counts are checked against the openings that follow them.
What is measured, and what is refused
Measured: sequence gaps, duplicates, administrative resets against gap-fills,
PossDupFlag, SendingTime regressions, logon terms, heartbeat compliance against the
agreed HeartBtInt, TestRequest and ResendRequest resolution, every reject with its
reason, ClOrdID chains, the order state diagram per chain leg, the quantity identity, the fills
against CumQty, AvgPx against the quantity-weighted mean, overfills, limit orders filled outside
their own limit, cancel and replace races measured to resolution, fill rates, venue and liquidity
mix, latency, notional and per-symbol VWAP.
Refused: any benchmark this file does not contain. If the capture carries no market data there is no slippage number, no spread capture and no implementation shortfall — a limit price is the trader's instruction, not the market. Refused too: any conclusion of misconduct. The tape section computes signatures and names the screens that consume them; it does not decide what they mean, because intent, account relationships and market context are not in a message log.