I am learning about Deauth attacks and how they work. I see that the Deauth frame has a reason code which indicates the reason for the deauth. I have tested the attack with aircrack-ng and this reason code always translates to "Class 3 Frame received from non associated station". Do other attack tools have the ability to spoof/tamper the reason code or is it always the same?
Second part of my question is about post attack scenario. Victim can black list the MAC which sent the Deauth frames but that MAC will be of the legitimate Access Point or another client. What are the options for a victim ?