Reconnaissance
These exploits, like most others, are implemented in a two-phased approach. The first phase is resonance. The attacker first collects "trigger" or "amplifier" networks. These are needed to execute the attack. To qualify as a potential amplifier, the network (specifically the router) simply needs to have IP broadcast forwarding enabled. Since this was the default state of most routers and workstations when this attack was devised, smurf amplifier networks were easy to find.