Apache Logging
As per @hermanb response on the other question you asked on this topic, the easiest way to do this is not via tcpdump or ngrep, rather its via simply grepping the apache logs - which record the information you want in an easier to read form, including the response code.
The log file location and layout will vary depending on your setup and are very customizeable. The default logs will likely have the information you want, but if not, you can create your own logs.
On my server there are lines
LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log vhost_combined
In the config file which creates a file /var/log/apache/other_vhosts_access.log. The "CustomLog" bit at the front says to use a custom log format, and the vhost_combined bit at the end describes the log format.
You can, of-course, have more then 1 log file, and more then 1 log format. This is all described at https://httpd.apache.org/docs/2.4/mod/mod_log_config.html#customlog
Once you have a format you can - in real time, grep the log file to see what you are looking for - for example,
tail -f /var/log/apache2/other_vhosts_access.log | grep --line-buffered " 200
"
would look at each line of the log file as its created and look for " 200 ". and using "grep -v" to invert the search. There are lots of more complex ways to get information out, buy using more complex grep expressions and/or more/other logging.
You should also read the page linked above as its got lots of information on formatting your own logs - for example maybe try
LogFormat "%s %v:%p/%r" statuscodelog
CustomLog /path/to/mylogfile.log statuscodelog
Which should, in theory, produce a simple output in the fom
200 example.com/requested/path1
500 example.com/requested/file/causes/error
You can then load this into a spreadsheet for easy analysis or grep this more specifically and simply by something like
tail -f /path/to/mylogfile.log | grep --line-buffered "^5"
To get a list of URLS returning status code 5**
Of-course, this can be tailored to catch whatever you want, in whatever format you decide to create. This is just a fairly minimal example.
Connection Close
This is a duplicate of What does "Connection: close" mean when used in the response message? - the accepted answer shows that the "Connection: close" is something the web server or client sends to show the connection should not be persisted. The link goes into more depth, but it is simply following the specification for an HTTP/1.1 connection for applications that do not support persistent connections.