I learned from ethical hacking tutorial and tested following command about DOS on Wifi.
aireplay-ng -0 0 -a [Wifi-MAC here]
It works fine, but my question is how can we avoid such attacks?
As schroeder eludes to in the original comment, the only real protection for most of us is to use wired solutions. There are a few options that are expensive or system intensive, and therefore are beyond the means of many users.
Let's dissect why 'the wired solution' is the answer in most cases.
The physics of radio emissions means that the only way to protect from the data being received in whatever format (encrypted or plaintext) is to physically block transmission. Read these for some background on how that problem has been addressed in some areas:
Now, consider what the de-authentication attack you describe is doing...
-0 means "send a de-authentication frame", and the following
0 means "send this type of frame continuously".
-a [MAC] means "send these frames so they appear to come from the Access Point identified as [MAC]"
-c [MAC] parameter means aireplay-ng will send the de-authentication frame to every station connected to the access point. If you had specified a single MAC, you would just be DOSing that station off of the wifi network.
That's fine and grand, and works as expected ... as you have seen. It basically sends a command to each connected station saying "disconnect now" and they obey, because the protocol is written that way.
This problem comes from, if I understand the details correctly, the inability of a station to validate the de-authentication frame. This is because the original standards did not require a mechanism for this. Any radio capable of broadcasting in the right frequency can send the data, and the original protocol did not require the stations to validate the source of the signal...it may not have even existed in the protocol, I am not certain.
As defalt mentions, some higher end SOHO and enterprise grade wifi solutions have Wireless-IPS capabilities. These are built upon systems that analyze traffic patterns and signatures, and make decisions about which signals to act upon.
More recent standards have improved on these issues; I am unaware of how widespread the adoption of the updated standards/protocols has gone, but from recent testing I can tell you a lot of my equipment is still vulnerable to this.