Smurf Amp Nets

Nah those are machines on the relay being used sending those replies.
Sometimes from machines given those ips and sometimes from misconfigured
networks. I used to have one that would reply 500 times from Just
because the broadcast being used is does not mean you will only
get packets from 1.2.3.x, and conversely because you receive pings from
1.2.3.x and 1.2.4.x and 1.2.5.x does not necessarily mean there are 3
broadcasts being used. It could easily be only on or even for all you know (and I've seen strange cases of each). This is a
complication when you are getting your bcasts from logs of a smurf attack
because you never really know where those's come from, and a
complication when you are getting your bcasts from a network scan because
you sometimes see huge arrays of broadcasts that are actually just the same
hosts being repeated on different broadcasts (ex: you just found - all have 200 dupes each, but closer examination reveals every
broadcast returns replies from the same host). Fortunately these problems
are even more annoying to the smurf kiddies where it is important to have an
accurate estimation of the damage that will be inflicted.