Strange ICMP packets...

I suspect packet three is a duplicate of packet 1. Notice the TTL: packet 1 is decremented (127 instead of 128). What is the span or mirror port setup? I would suspect two source ports into a single destination.

I can replicate something very close, except for the specific timing. With a poorly(*) configured port mirror or span setup on my switch/router, I can end up with the same as you have:

The ttl change is telling in that you crossed a router so it is not likely a layer2 loop or anything like that; the specific configuration for this is to configure a router with mirror port capability and then:

1. Copy ingress of incoming ICMP request from the source, so in my case port connected to 192.168.1.14 (/24). So we see an ICMP request with full TTL. We would not see any response because we limited to ingress. Frame 4.
2. Copy BOTH ingress and egress of ICMP response, so port connected to 192.168.3.178. We will see the ICMP request as it leaves the router so ttl is decremented, and then the response with full ttl as we see it before routing. We see both because we have ingress and egress set. Frames 5 and 6.
3. Destination mirror for this test was the same port for both of these links

There are probably other ways to get this. The timing is dependent on a lot of things. I have seen Cisco span ports mirror packets out of order (obvious to see when it happens with TCP). This diagnostic feature is usually lower priority than other device functions, so you never really know how that will affect the timing. What happens when we mirror two 1GB ports into a single 1GB destination? Not good things...

Also the negative timestamp is common for me when I capture on two separate interfaces at the same time. Instead of setting the mirror destination to the same port as in point 3 above, use separate destinations but capture on the same PC, with two NICs. Make one of the them a USB NIC and heavily load the system. Timing could be a mess.

*My assertion that this is poor is true for me - I have no need to configure my span ports in this manner for my daily work. However, it may be perfectly valid for whatever it is you are trying to do. For understanding ICMP echo flows across a router this is probably not the best choice.