Netflow Collection Engine -

The engine opens a UDP socket (typically port 2055, 9995, or 4739) to listen for traffic.

Flow analysis relies heavily on timestamps. If the router's clock (exporter) and the collector's clock are not synced via NTP, flow reconstruction becomes inaccurate, leading to broken TCP session graphs. netflow collection engine