grep utility will do buffering of its output when it isn't connected to a terminal. You will not see any output in the
/tmp/output files until the output buffer of
grep has been filled and flushed.
This will only be an issue for as long as
ngrep is running. Once
grep will flush its output buffer before it too terminates.
This buffering is done for performance reasons. Flushing a line of text to the output takes a short amount of time, but when massive amounts of data is involved, this slowes the pipeline down.
You may turn off the buffering that
grep does, or rather, enable line-buffering. With BSD and GNU
grep, this is done with the non-standard option
--line-buffered, so you'll get
sudo ngrep -W byline -qilw get tcp dst port 80 |
grep --line-buffered -i '.*' |
Or, you could just remove that
grep completely as it will pass all lines from
ngrep on to
tee (the regular expression
.* matches on every line, no matter if it's empty or not).