[Abagail]

If you turn off the actual connection cookie system and not the logging of it in the console you are vulnerable to attacks such as the Server Full attack. The connection cookie system validates the connection is actually coming through the client to prevent outside connections filling up slots but never actually connecting.

If you are being spammed by connection cookie requests you can either ban the IP if it's a single IP or disable connection cookie logging so it doesn't show up / spam the console - though directly disabling the system I'd say is a bad idea.