While performing ping scans into a target network you get a frantic call from the organization's security team. They report that they are under a denial of service attack. When you stop your scan, the

Scanning more slowly reduces packet volume but does not change the broadcast ICMP pattern that triggers the Smurf attack IDS signature.

A Smurf attack sends ICMP echo requests to a network broadcast address with a spoofed source IP, causing every host on the segment to reply to the victim and creating a flood. When a ping scan includes the broadcast address, it produces the same ICMP-to-broadcast signature that Smurf detection rules watch for. Removing the broadcast IP from the scan target list eliminates this pattern entirely and prevents the false-positive IDS alert.

Spoofing the source IP makes your scan more closely resemble an actual Smurf attack, which would escalate the IDS alert rather than suppress it.

Restricting scans to Windows systems is unrelated to the broadcast address behavior that triggers the Smurf detection rule.