In Kali you can:
airmon-ng start wlan0
ifconfig mon0 down
macchanger -r mon0 (-r changes mac id to a random number)
ifconfig mon0 up
This attack for example: aireplay-ng -0 2 -a [ap mac #] -c [client mac #] mon0
While using snort it detects the attack but with the spoofed mac.
In wireshark focused on mon0 you can see the source and see its a --deauth packet to client mac but how can it detect a spoofed mac and see the real one?