TNS listener is a service that allows clients application to connect to oracle database. The service running on the database allows to log and control the connection and by default it uses port 1521/1526. Database administrator needs to restrict this port to only required applications by filtering IPs.
Each connection over this service logs information about the client such as the IP address, time of connection, port source and the connection string. During the forensic analyses these information are important to identify malicious attack or abnormal connections.
TNS Connection Profiler for Oracle is the tool that can be used to analyze log information for forensic and auditing database instances and connections.
You will have the count number for each IP which indicate if all is normal or you have some connection that are not sourced from the application. All you need is to provide the log file and the tool will organize you the result to have a better visibility about each instance.
You can download the tool over this link: http://www.databaseforensics.com/TNSConnectionProfilerforOracle.htm