After about two years in deep freeze, I revived the idea of a dropped table. For those of you who haven't heard about it in the past: The idea is to gather all packets that are dropped at any place within the network stack. This is very useful for auditing and debugging.
Userspace support is included in libiptc/iptables for ages, so all you need is patch-o-matic-ng from >= today.