IPv4 and UDP/TCP packets inside of ICMP packet?

Question

A week ago, after opening wireshark, i was surprised by seing a storm of ICMP packets from different IP addresses. While deep analysing of thoses packets, i noticed that those ICMP packets contains IPv4 headers and UDP/TCP headers. It seems like port scanning. I spent a lot of time searching of an answer of how this is possible but i didnt find anything. I know that there is an attack named ICMP tunneling but i dont think that there is some tunneling in this case.

Here is some other pictures:

https://ibb.co/TvmZS6Y
https://ibb.co/FnpsVVR
https://ibb.co/rMqwgyv
https://ibb.co/pZPXTgC

Answer 1

An ICMP error message will contain the IP header and first 64 bits (eight octets) of the original data. See RFC 792, Internet Message Control Protocol:

Internet Header + 64 bits of Data Datagram

The internet header plus the first 64 bits of the original datagram's data. This data is used by the host to match the message to the appropriate process. If a higher level protocol uses port numbers, they are assumed to be in the first 64 data bits of the original datagram's data.