How to extract attack-free data from snort IDS?Help!

Hello evryone:
As usual, snort logs the attack-data to file or database. As the data
stream from networks, snort eliminate the attack-free data. And i was
interested in finding out the attack-free data that snort eliminate. I
read snort's manual and the Snort FAQ,but i can't find any reference
to doing this.

And there are two problems :
##Problem No-1 : I should use the rest of traffic data after snort
detected, and these data have the same information or description as
the attack data that are detected by snort.My origin idea for it is
to use the timestamps to eliminate the attack-data from the whole
data. But how to do this?

And are there any way to log two data set(attack and attack-free )to
Mysql database?
Just like this :
if there is attack
then alert and log to mysql attack database or log to a attack
file;
else
log to mysql attack-free database or log to a attack-free file

##Problem No-2 :And come out the problem: if the created attack-free
file is TCPDUMP format file, then i have to use snort to process the
tcpdump file. It costs much time and resources.

But the most important is problem No-1. The problem No-2 is followed
by No-1.

Thank you for any advice!!

Lawrence