Any chance I could get you to capture the traffic again, after disabling ssl on the remote system? Starting both the remote host and the check_nrpe with -n should allow you to avoid ssl entirely. I can see some strangeness happening with your connection between the two, but I can't tell what it is since it's encrypted.
Also if you could post the script after modifications please.
Nagios-Plugins maintainer exclusively, unless you have other C language bugs with open-source nagios projects, then I am happy to help! Please pm or use other communication to alert me to issues as I no longer track the forum.
Instead of monitoring the process itself, why not run a simple Oracle query over TNS such as:
SELECT COUNT(*)
FROM V$INSTANCE;
This would test both PMON and the listener in one step and can be a good template for many operating systems. You could likely get fancy in testing the HOST_NAME column to the $HOSTADDRESS$ field.