dasHost.exe is causing udp broadcast flood on 22222 or 10004 ports...

Question

Hi i have problem with Device Association Framework Provider Host..

I checked das host is running from right place C:\Windows\System32

Its signed by ms.

How to stop it? It is hundreds broadcast connections per miute..

System is updated, antivirus is working.

Answer 1

Dear Pawel Bober,

Thank you for reaching out about the issue with dasHost.exe causing a UDP broadcast flood on ports 22222 and 10004. I understand how frustrating this can be, and I’m here to assist you in resolving it.

Here are some steps you can follow to address and mitigate this problem:

Step 1: Monitor Network Activity Using Task Manager and Resource Monitor

• Press Ctrl + Shift + Esc to open Task Manager.
• Go to the Performance tab and click on Open Resource Monitor at the bottom.
• Switch to the Network tab to view detailed network usage.
• Confirm if dasHost.exe is indeed responsible for the excessive network activity.

Step 2: Check and Disable the Device Association Service (if necessary)

• Press Win + R, type services.msc, and press Enter.
• Locate Device Association Service, right-click it, and select Properties.
• Change the Startup type to Disabled, then click Apply and Stop the service.
• This service is linked to device associations like printers or Bluetooth devices. Disabling it temporarily should stop the flood of UDP broadcasts.
• You can always re-enable the service if needed.

Step 3: Configure Group Policy to Prevent Device Installation

• Press Win + R, type gpedit.msc, and press Enter.
• Navigate to Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions.
• Set up policies here to prevent unauthorized device installations, which might be malfunctioning and causing network floods.

Step 4: Block UDP Ports Using Windows Firewall

• Press Win + R, type firewall.cpl, and press Enter.
• On the left pane, click Advanced settings.
• In the Outbound Rules section, click New Rule….
• Select Port and click Next.
• Choose UDP, and specify the local ports 22222, 10004.
• Select Block the connection, and apply the rule to all profiles (Domain, Private, Public).
• Name the rule something like “Block dasHost UDP Broadcasts” and complete the setup.

Restart your system for the changes to take effect. After that, monitor the network activity using Task Manager and Resource Monitor to ensure that the UDP broadcast has been significantly reduced.

Please feel free to reach out again if the problem persists or if you need any further assistance.

Best Regards,

Martin | Microsoft Community Support Specialist

Answer 2

I am also having the same issue with both ports 22222 and 10004, what you suggested is simply a workaround and I cannot implement these things in our corporate environment. I am seeing over 350,000 packets in the last ten minutes from one device alone. Can I get assistance in figuring this issue out? It's starting to impact our company network. Thanks

Answer 3

I'm experience the same.

Is it from the last update of Windows 11 24H2?

dasHost.exe,"10.0.26100.1882","04-Oct-2024","18:33","166,912"

Answer 4

Also seeing this on a fairly new install of Windows 11 24H2

I have blocked the outbound traffic to stop the network from becoming congested but this is a bandaid at best.

Has there been any progress on this, either a cause or any better workarounds/fixes?

Answer 5

I'm still trying to figure out the root issue, but it appears to be tied to Edge/Chrome's new Print wizard when on Win 11 24h2.

It seems whenever a user prints from either Edge or Chrome and their new Print wizard loads, it does some sort of broadcast printer search that never ends.

It seems when I kill the service "net stop deviceassociationservice" it ends the udp storm. But then when they print again it starts again.

I'm not sure what the root of the issue is though.

We have users that have to print from the browser, and I have tried forcing Chrome/Edge to use the system print service, but I'm getting partial success with even that.