dasHost.exe is causing udp broadcast flood on 22222 or 10004 ports...

Anonymous
2024-10-16T07:33:40+00:00

Hi i have problem with Device Association Framework Provider Host..

I checked das host is running from right place C:\Windows\System32

Its signed by ms.

How to stop it? It is hundreds broadcast connections per miute..

System is updated, antivirus is working.

Windows for home | Windows 11 | Internet and connectivity

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments No comments

61 answers

Sort by: Most helpful
  1. Anonymous
    2025-04-11T13:57:57+00:00

    We've continued testing on behalf of Microsoft and have found the issue: When a limited user selects print, the window that opens begins searching for printers on the network, and this is when the flooding occurs indefinitely.

    This is the same that happens when you select add a printer in settings, except that the user hasn't selected add a printer, only print.

    Therefore, we were able to stop the flooding by creating a GPO that doesn't allow limited users to install printers.

    Was this answer helpful?

    0 comments No comments
  2. Anonymous
    2025-04-11T13:40:51+00:00

    Was scanning my site network (Wireshark) yesterday and located a subject PC that was generating multiple packets on port 22222/10004. It had the KB5055523 2025-04 patch installed, so MS either haven't fixed or it is something else connected with printer discovery. I applied the registry key

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Print\UnifiedPrintDialog] "PreferLegacyPrintDialog"=dword:00000001

    Re-started PC and all went quiet. I do not have any idea what triggers this. I see small bursts of UDP 22222 from various machines but that is all. Something appears to get stuck in a loop when the flood is happening - I can see 75 or more UDP packets to 22222 and 10004 from a PC in 1 second.

    Was this answer helpful?

    0 comments No comments
  3. Anonymous
    2025-04-09T06:12:43+00:00

    KB5055523 2025-04 問題依然存在

    Was this answer helpful?

    0 comments No comments
  4. Anonymous
    2025-03-28T15:40:05+00:00

    Exact same boat here. We're dependent on the BD firewall, and it doesn't have the ability to filter broadcast traffic (according to them, this is due to a bug with the Windows Filtering Platform, not a decision on their part). The registry trick has greatly reduced how often people start the broadcast, but it still happens without fail when printing from certain applications (photos.exe, snipping tool, etc.). Our only recourse at the moment is watching for the traffic in wireshark 24/7 and manually killing dashost.exe as soon as someone starts being problematic (or scripting the same steps). It's truly heinous and all we can do is angrily await a new build that hopefully fixes the issue.

    We're in the same, 120 computers and as they've been updated, it's become unsustainable, I have logged 4 broadcasts per second per computer, network stability is clearly in danger, It's incredible that Microsoft hasn't fixed this!

    We've disabled the device association service and the broadcasts disappear, but programs that use native Windows printing fail or take forever (Notepad, Paint, Photos...)

    We use BitDefender Firewall instead of the Windows one, and not permit drop broadcast...

    Any other suggestion?

    Was this answer helpful?

    0 comments No comments
  5. Anonymous
    2025-03-26T22:53:18+00:00

    Same here. Rolled out a GPO with firewall rule blocking those outbound ports seems to have fixed the issue. Blocking those ports hasn't caused any issues with production so far.

    Was this answer helpful?

    0 comments No comments