Question : Why does FTP show an established connection to a non-existant host?

Try this:  (from XP workstaton)
Open two command prompts.

In one command prompt, type:
     ftp 10.255.254.254  (or any non-existant host address you make up)

In the other command prompt, type:
netstat -na | find /i ":21"
  TCP    10.0.1.22:4945         10.255.254.254:21      ESTABLISHED
  TCP    10.0.1.22:4947         10.255.254.254:21      SYN_SENT

I can understand the SYN_SENT because it is trying to establish a handshake, but why would it show a "ESTABLISHED" connection when the host address is non-existant?

Answer : Why does FTP show an established connection to a non-existant host?

Yes, ARP should be the only packet cause before attempting the connection, it should have the MAC address of the destination computer...No Computer, No Reply....Ok...Try this...Can you reboot your box into safe mode with Networking and try this again...I somehow feel this is NOT the stack but some third party software which is causing this display of incorrect information.