answered 2018-10-21 08:32:50 +0000
Because an ICMP Time Exceeded message contains "The internet header plus the first 64 bits of the original datagram's data.", as per RFC 792.
