It mainly comes from just watching l2 of any given stock. When its running, which mm comes in to slow it down. Also, they are the last one to leave the ask before it goes up. Then you also get into ECN'S (Trac, Data, Gnet, etc). They are sometimes used by mms to hide their true intentions. Like one posted earlier, you cant just sit down and type it all. It just comes with time and experience.