-f will display the results of the tail as it's written yes.
So, if you tail -f <somefile> it'll sit and display your file. As more is added to your file it'll display that too. Useful for realtime monitoring of logfiles and the like. It's not specific to a syslog - you can tail -f anything.
You can also :
tail -100 <somefile> for the last 100 lines. The default is 10, but you can specify any number of lines you ilke.
To address the problem :
when i run the script, i can see the filtered output.
you shouldn't see anything. The redirector '>" should redirect the output from the tail to your file. What you should see is a blank, flashing cursor, and any output from the tail will be redirected from being displayed on screen (stdout) to your file. ctrl-c will kill it and you'll get your prompt back.
That you are seeing output corresponds to your lack of output in your file. You only have one output stream and it's going to your screen and not your file.
What you want is this :
tee - read from standard input and write to standard output and files
And your script should look like this :
tail -f /var/log/syslog | grep "PROTO=TCP" | tee /root/connections.log