TNS Headers

Every TNS packet has an 8-byte header. 

Byte 0-1 (WORD) is the packet length inclusive of the header in big-endian format.

Byte 2-3 (WORD) is the packet checksum if applicable.  Default is not used and fill with value 0x0000.

Byte 4 contains the packet type

Type	Description
1	Connect
2	Accept
3	Ack
4	Refuse
5	Redirect
6	Data
7	NULL
9	Abort
11	Resend
12	Marker
13	Attention
14	Control

When client connects to the Oracle server (Listener), it sends a Type-1 Connect packet specifying the service name it wishes to access

The listener will  send a Type-2 Accept packet if the service is known.  The listener may also send a Type-5 Redirect packet to the client to redirect it to another port.  The client upon receiving the Redirect packet will send a Connect packet to the alternate port.

Once the connection is accepted, the client will proceed to authenticate.  All authentication packet is Type-6 Data.

If the service is unknown, the Listener will send a Type-4 Refuse packet.

All queries and results are sent in Type-6 Data packets.  Once in awhile, there will be Type-12 (0x0C) Marker packet serving the purpose to interrupt.  For example, the server may send a Marker packet to tell the client to stop sending data.

Byte 5 is the header flag which is generally unused.  10g client may set to 0x04.

Byte 6-7 (WORD) contains the header checksum which is also not used by default and set to 0x0000

The Refuse packet is also sent when the login fails.  Byte 54 shows if this is due to invalid ID (0x02) or password (0x03)