With Rpi-Monitor running on the port 8888, i have frequently this kernel message in my log :
kernel: [215850.589469] TCP: request_sock_TCP: Possible SYN flooding on port 8888. Sending cookies. Check SNMP counters.
I also have this same message type for different services (RadarBox, FR24, etc.) on port 3005.
I f you have the same, and if this TCP connections are legitimate (check with netstat), you can solve this like me :
First check what is the number actualy used : sysctl net.core.somaxconn
In my case it was 128 (Raspbian Buster), so i updated it to 512 : sysctl -w net.core.somaxconn=512
To keep this setting after a reboot : echo "net.core.somaxconn = 512" >> /etc/sysctl.conf
You need to do the same for net.ipv4.tcp_max_syn_backlog :
sysctl net.ipv4.tcp_max_syn_backlog
sysctl -w net.ipv4.tcp_max_syn_backlog=512
echo "net.ipv4.tcp_max_syn_backlog = 512" >> /etc/sysctl.conf
After that no more Kernel message.
If you want you can try with a value less than 512, such as 256 !