Counts ICMP Time Exceeded messages received by the device, typically generated by a router along a path when a packet's TTL hit zero. A rise here specifically on a firewall usually comes from traceroute-style diagnostic traffic or, less innocently, TTL-based network reconnaissance probing the path, either way evidence someone is mapping the hop count to or from this gateway. Example: a burst of icmpInTimeExcds right before a fwRejected spike from the same external range suggests the source was traceroute-mapping the path before launching whatever probe got rejected.