NetFlow: who talks to whom, how much and when
Every mechanism has a step-by-step animation, the configuration explained line by line and the exam notes. Where a parameter changes the outcome, you get a simulator in which you change it yourself.
TL;DR
NetFlow turns the traffic passing through a router into records: the router reads the headers, groups packets with the same key fields (addresses, ports, protocol, ToS, input interface) into flows, counts them in a cache and, when the flow expires (15 s without packets, 30 minutes of activity or FIN), sends the record to a collector over UDP, in v5, v9 or IPFIX format. Flexible NetFlow splits everything into a flow record, a flow exporter and a flow monitor, applied input on the interfaces; the sampler picks 1 packet in N when the traffic is too high; NBAR2 adds the application name. Most problems come from templates sent too rarely, missing options, firewalls on UDP 2055 and monitors applied on both input and output.
How to read the notes: red = critical for the exam, green = theory, blue = numbers, yellow = pitfalls, cyan = differences between platforms and standards. In the animations, the configuration lines used in the current step are highlighted automatically; the ← → arrows change the step when the animation is selected.
The analogy, in short
Think of a factory gate with a gatekeeper who keeps a logbook: for each route (where the truck comes from, where it's going, what goods it carries, which gate it came in through) he writes one line and adds up the trucks; he never opens a crate. When a route goes 15 minutes without trucks, or the shipment lasts all day, the line is closed and goes in an envelope to accounting, with no acknowledgment. At rush hour he notes 1 truck in 100 and puts a slip saying so in the envelope.
The model holds up to §9. From §10 on (application recognition, hardware limits, malware detection in encrypted traffic), it breaks; see the full analogy and its limits in §15.