Oracle is multi-process database. It does not use threads (on the contrary to other databases). Some of the processes are background ones (Oracle internal) the other ones are user sessions processes. They all communicate via IPC (messages, shared ram).
When user opens a TCP connection to listener, the listener process forks and then executes(exec) oracle binary. This new process becomes a new Oracle session process. In this case Oracle protocol is wired - i.e. it uses only a single TCP connection (port 1521).
There is also more complicated way(especially on RAC). Listener instructs Oracle background process(PMON) and this one forks a new Oracle process, listening on a new dynamically allocated port. Listener then sends a "redirect" message to client process. Client then connects (via new TCP) to the session process.
This redirect message can point onto another cluster node(having different IP address)
PS: due this redirect, you should not use NAT and also both client and server should use the same DNS server(or at least server serving the same records).
I think this redirect message contains a hostname, not IP address.