can somebody put light on this issue??

What are you trying to accomplish?

I want to port snort into kernel so that it can work more efficiently and its performance becomes better then in usrland....

Well, I think you'll find that this will be the most painful thing you've ever attempted. It won't be a matter of porting it so much as rewriting it and adapting the technology to kernel space. There are many things that either don't work or are very difficult from kernel space; one of which is file access. If you really think you must attempt this, then I'd suggest you get "Linux Device Drivers" by Corbet, Rubini, and Kroah-Hartman, and start experimenting with device drivers. You'll probably discover pretty quickly that user apps don't make a good fit to kernel space. I think the rule of thumb is that a process should be in user space if it can be in user space, or something like that. There are no automatic improvements in speed and efficiency just from running in kernel space. It's not an accident that X runs in user space.

Yes your advise is true....but after thinking on ur suggestion i have decided to put into kernel only the parts where snort sniffs the packet and test it using a structure in kernel that stores all the signature rules so that instead of using file access in kernel we can use structure to store the rules and access them so that it will lead to performance.... If any more suggestions please let me know...i m still linux amature!!

Well, start with the book is really all the advice I can give you. Good luck!