At my REQUEST, Wellfleet changed the behavior of their router software so that it WOULD respond to broadcast pings (ones aimed at networks on which the router has an interface directly attached, that is). In general, routers do NOT know that a particular packet is directed to a broadcast address; that's up to the end router to deal with, setting a broadcast MAC address in the final hop. I frequently use "broadcast pings" to see what's on a network.