While performing ping scans into a target network you get a frantic call from the organization's security team. They report that they are under a denial of service attack. When you stop your scan…

Slowing the scan rate does not change the fundamental issue of directing ICMP traffic to the broadcast address, so the smurf attack signature would still trigger the IDS.

A smurf attack works by sending ICMP echo requests to a broadcast address, causing all hosts on the subnet to flood a target with replies. When a ping scan hits the broadcast IP, the same pattern occurs - every host responds - which the IDS correctly identifies as a smurf attack signature. Excluding the broadcast IP from the scan eliminates this traffic pattern entirely.

Spoofing the source IP would intensify the smurf-like behavior by redirecting all ICMP replies to a third-party host, potentially causing a real DoS condition.

Limiting scans to Windows systems has no bearing on whether the broadcast IP is targeted; the IDS event is triggered by the broadcast address, not by the OS type of the scanned hosts.