Are you using Orion NetFlow Traffic Analysis (Orion NTA) on the same box as Toolset? If so, it is possible that the Orion NTA collector has port 2055 open. Try shutting down the NTA collector service. You may also want to use "netstat -abn -p UDP" on the command line to see if you have another app using UDP port 2055. Also, you may want to verify using a packet sniffer (e.g. Wireshark) that you are receiving flows. If you verify that you are indeed receiving flows, and that another app isn't using port 2055, check in the rightmost column of the first screen that NetFlow Realtime shows you when it first starts - there should be a green checkmark for each interface from which NetFlow Realtime has seen flows. Unless it has seen flows regarding a particular interface, NetFlow Realtime will not allow you to begin a capture for that interface.
Let me know if this helps.