Nmap can be used to determine if a system is functioning as an Oracle server using the command
nmap -p 1521 -P0 -sT <ip_address>. Port 1521 is a port used by Oracle server software, but the port may also be used by other software, so, if nmap reports the system is listening on that port, it does not guarantee that the system is an Oracle server.
The options specified above are as follows:
-p <port ranges> This option specifies what ports you want to query. -P0 Do not try and ping hosts at all before scanning them. This allows the scanning of networks that don't allow ICMP echo requests (or responses) through their firewall. -sT TCP connect() scan: This is the most basic form of TCP scanning. The connect() system call provided by your operating system is used to open a connection to every interesting port on the machine. If the port is listening, connect() will succeed, otherwise the port isn't reachable. One strong advantage to this technique is that you don/t need any special privileges. Any user on most UNIX boxes is free to use this call.
For a list of other ports used by Oracle, you can check Which TCP/UDP port or ports does 'oracle' use?