I am capturing level 2 data (TCP). I work under the assumption that the only way for a level 2 transactions to be canceled (ask or bid) is that a zero value be sent to the bid/bid size or the ask/ask size; or a replacement bid/bid size or ask/ask size.

At the end of the day I am left with maybe 10 to 15 unclosed u transactions on the ask side. Usually these exist on the ask side only, and they usually are less than 200 ask size quantity.

I am not checking reason code, condition code, bid info valid, or ask info valid. Are my assumptions correct so far?

The second part of the question when should I consider all transactions not accounted for as "no longer valid?". Should market close determine that... and should I be using the c<cr><lf> to trigger that in the 9200 TCP stream; or should I always expect a canceling "u" transaction?