While performing ping scans into a target network you get a frantic call from the organization's security team. They report that they are under a denial of service attack. When you stop your scan, the

Scanning more slowly reduces overall traffic volume but does not eliminate the broadcast reply amplification that triggers the smurf attack IDS signature.

A smurf attack works by sending ICMP echo requests to a broadcast address so that every host on the subnet replies, flooding the apparent source. When a ping scan includes the broadcast IP, it generates the same mass-reply traffic pattern that IDS signatures detect as a smurf attack. Excluding the broadcast IP from the scan eliminates this pattern while still allowing the rest of the network to be scanned.

Spoofing the source IP would redirect all the broadcast replies to the spoofed address, making the attack worse and not preventing the IDS alert.

Restricting scans to Windows systems does not prevent targeting the broadcast IP, which is the root cause of the smurf-like event.