It's created by macOS. They requested a link-layer header type for pcap/pcapng for that purpose, and were assigned one. Wireshark supports dissecting it.