Troubleshooting Alert.log Timeout Errors in 11g and Newer
Troubleshooting timeout errors in the alert.log is usually quite simple. Typically, the client's IP address and the port used by the client are posted to the alert.log.
It's easy to determine when the connection arrived by searching or using grep to locate the same text in the listener logs. If you find it was terminated long after
it was established, it's generally firewall related.
See the following document for an explanation:
Doc ID 1628949.1 Alert Log Errors: 12170 TNS-12535/TNS-00505: Operation Timed Out
Take the client ip and port from the error stack in the alert.log. Grep or search your listener logs for that string. Compare the timestamp of the established