In the case that there is an ongoing attack in my network, where the attacker is using WLAN to access my network and I recognize it, would it be possible to send a broadcast deauth in my network to temporarily stop the attack (as a "bruteforce solution")?
Are there possibilities for the hacker to protect himself against deauth packages (assuming he is not able to change the router settings)?
Short answer: Yes.
The deauth-packages are part of the management control frames used in 802.x communications. That means, they are usually handled in driver-land. So if it is not an advanced attacker (who'd probably go about this a different way anyways), you'll successfully make the attackers wifi-controller disassociate from your network.
But let's consider a worst case scenario:
Your attacker is dropping every 802-Deauth-package he's receiving. His tools are capable of constructing raw wifi frames, he's in total control of his wifi driver.
Even if you could not disassociate him, your router will still pretend the deauth happened and will discard all future packets. The attack would therefore stop non-the-less.
Also, I would not call it a brute-force last resort either. An Intrusion Detection System will be able to specially block the attackers MAC-Address.
