Index: filter_autocomplete.c
===================================================================
--- filter_autocomplete.c	(revision 26577)
+++ filter_autocomplete.c	(working copy)
@@ -57,9 +57,71 @@
                          gchar *prefix, 
                          GtkWidget *main_win);
 static void filter_autocomplete_win_destroy_cb(GtkWidget *win, gpointer data);
+static gboolean is_protocol_name_being_typed(GtkWidget *filter_te, gchar 
+*str);
 
 
+/*
+ * Check if the string "str" is a beginning of a protocol name.
+ * Possible false positives:
+ * 	"NOT" at the beginning of the display filter editable text.
+ * 	"NOT" adjacent to another logical operation. (e.g: exp1 AND NOT exp2).
+ **/
+static gboolean
+is_protocol_name_being_typed(GtkWidget *filter_te, gchar *str)
+{
+	unsigned int i;
+	int op_len, cursor_pos;
+	gchar *start;
+	gchar *pos;
+	static gchar *logic_ops[] = { "!", "not",
+																"||", "or",
+																"&&", "and",
+																"^^", "xor" };
 
+	/* If the cursor is located at the beginning of the filter editable text,
+	 * then it's _probably_ a protocol name.
+	 **/
+	if(!(cursor_pos = gtk_editable_get_position(GTK_EDITABLE(filter_te))))
+		return 1;
+
+	start = gtk_editable_get_chars(GTK_EDITABLE(filter_te), 0, cursor_pos);
+
+	/* Point to one char before the "str" in the filter editable text */
+	pos = start + (cursor_pos - strlen(str));
+
+	/* Walk back through string to find last char which isn't ' ' or '(' */
+	while(pos != start)
+	{
+		if(*pos != ' ' && *pos != '(')
+		{
+			/* Check if we have one of the logical operations */
+			for(i=0; i<(sizeof(logic_ops)/sizeof(logic_ops[0])); i++)
+			{
+				op_len = strlen(logic_ops[i]);
+
+				if(pos-start+1<op_len)
+					continue;
+
+				/* If one of the logical operatios is found, then the "str" is 
+_probably_ a protocol name */
+				if(!strncmp(pos-op_len+1, logic_ops[i], op_len))
+					return 1;
+			}
+
+			/* If none of the logical operations was found, then the "str" is not a protocol */
+			return 0;
+		}
+		pos--;
+	}
+	
+	/* The "str" preceded only by ' ' or '(' chars, 
+	 * which means that the str is _probably_ a protocol name.
+	 **/
+  return 1;
+}
+
+
 static void
 autocomplete_protocol_string(GtkWidget *filter_te, gchar *selected_str)
 {
@@ -316,7 +378,8 @@
       if(strchr(prefix, '.')) {
         popup_win = filter_autocomplete_new(filter_te, prefix, FALSE);
         g_object_set_data(G_OBJECT(w_toplevel), E_FILT_AUTOCOMP_PTR_KEY, popup_win);
-      } else if(strlen(prefix)) {
+      } else if(strlen(prefix) && 
+is_protocol_name_being_typed(filter_te, prefix)) {
         popup_win = filter_autocomplete_new(filter_te, prefix, TRUE);
         g_object_set_data(G_OBJECT(w_toplevel), E_FILT_AUTOCOMP_PTR_KEY, popup_win);
       }
@@ -329,7 +392,7 @@
   } else if(g_ascii_isalnum(ckey) && !popup_win) {
     gchar *name = g_strconcat(prefix, event->string, NULL);
 
-    if( !strchr(name, '.') ) {
+    if( !strchr(name, '.') && is_protocol_name_being_typed(filter_te, name) ) {
       popup_win = filter_autocomplete_new(filter_te, name, TRUE);
       g_object_set_data(G_OBJECT(w_toplevel), E_FILT_AUTOCOMP_PTR_KEY, popup_win);
     }