ORA-3136: WARNING Inbound Connection Timed Out


客户遭遇后台报错:"ORA-3136: WARNING Inbound Connection Timed Out",而且连续几十条,但前段的用户似乎没有异常的状态反应,对用户到没有造成什么影响。ORA-3136的成因相对复杂,可能有很多种可能,例如在MOS中有篇文档[ID 465043.1],详细的介绍了可能性:
The following are the most likely reasons for this error: 
1.Server gets a connection request from a malicious client which is not supposed to connect to the database.  In this case the error thrown would be the expected and desirable behavior. 
You can get the client address for which the error was thrown in the sqlnet.log file that is local to the database. 
2.The server receives a valid client connection request but the client takes a long time to authenticate more than the default 60 seconds. 
3.The DB server is heavily loaded due to which it cannot finish the client logon within the timeout specified
The "WARNING: inbound connection timed out (ORA-3136)" in the alert log indicates that the client was not able to complete
the authentication process within the period of time specified by the parameter SQLNET.INBOUND_CONNECT_TIMEOUT
"opiino: Attach failed! error=-1 ifvp=0"
From onwards the default setting for the parameter SQLNET.INBOUND_CONNECT_TIMEOUT is 60 seconds.
If the client is not able to authenticate within 60 seconds, the warning would appear in the alert log and the client connection will be terminated
Note: This timeout restriction was introduced to combat Denial of Service (DoS) attack whereby malicious clients attempt to flood database servers with connect requests that consumes resources.
The default value of 60 seconds is good enough in most conditions for the database server to authenticate a client connection. If it is taking longer, then it's worth checking the following items before implementing the workaround:
1. Check whether local connection on the database server is successful & quick.
2. If local connections are quick ,then check for underlying network delay with the help of your network administrator.
3. Check whether your Database performance has degraded in anyway.
4. Check alert log for any critical errors for eg, ORA-600 or ORA-7445 and get them  resolved first. 
These critical errors might have triggered the slowness of the database server.
It is often necessary to increase the values for INBOUND CONNECT TIMEOUT at  both the listener and the database in order to resolve this issue.It is usually advisable to set the database (sqlnet.ora) value slightly higher than the listener (listener.ora).    The authentication process is more demanding for the database than the listener.
To set these parameters to use values higher than the default of 60 seconds, follow these instructions and restart the listener. 
There is no need to restart Oracle: 
Edit the server side sqlnet.ora file and add this parameter:
SQLNET.INBOUND_CONNECT_TIMEOUT=<n>  Where <n> is the value in seconds.
Edit the listener.ora file and add this parameter: 
INBOUND_CONNECT_TIMEOUT_<listenername> = <n>  Again, where <n> is the timeout value in seconds.  
For example if the listener name is LISTENER then use:
更详细的信息可以参考mos中的文档[ID 465043.1]