TAP设备tap0跨LAN通信时的网关MAC地址是什么？

我正在跟随教程编写自定义网络栈，推进到IP层时遇到瓶颈：当目标主机处于不同LAN时，不知道以太网帧中应填入什么目的MAC地址。按网络原理应发送至网关，但在此场景下网关是什么？

我在WSL的Linux主机上创建了可读写的TAP设备tap0，当前网络设备信息如下：

$ ip a sh
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:15:5d:ef:2e:0c brd ff:ff:ff:ff:ff:ff
    inet 172.22.47.121/20 brd 172.22.47.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::215:5dff:feef:2e0c/64 scope link
       valid_lft forever preferred_lft forever
5: tap0: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 1000
    link/ether 3a:7b:50:89:b7:1b brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.4/8 brd 10.255.255.255 scope global tap0
       valid_lft forever preferred_lft forever
    inet6 fe80::e05e:8eff:fea6:e965/64 scope link
       valid_lft forever preferred_lft forever

$ ip route
default via 172.22.32.1 dev eth0 proto kernel
10.0.0.0/8 dev tap0 proto kernel scope link src 10.0.0.4
172.22.32.0/20 dev eth0 proto kernel scope link src 172.22.47.121

我用于打开tap0的C代码如下：

void open_tap_dev(char *name, char *ip_addr, tun_device* device) {
    struct ifreq ifr;
    int sock;

    if ((tun_fd = open("/dev/net/tun", O_RDWR)) < 0) {
        perror("Cannot open TUN/TAP device");
        exit(1);
    }

    memset(&ifr, 0, sizeof(ifr));

    ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
    if (name == NULL) {
        printf("device name has to be set\n");
        exit(1);
    }
    strncpy(ifr.ifr_name, name, IFNAMSIZ);

    if (ioctl(tun_fd, TUNSETIFF, (void *) &ifr) < 0) {
        perror("Could not ioctl tun");
        close(tun_fd);
        exit(1);
    }

    sock = socket(AF_INET, SOCK_STREAM, 0);
    if (sock < 0) {
        perror("Unable to create socket");
        close(tun_fd);
        exit(1);
    }
    if (set_ip(&ifr, sock, ip_addr) < 0) {
        close(tun_fd);
        exit(1);
    }
    device->ip_addrn = htonl(inet_network(ip_addr));

    ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
    if (ioctl(sock, SIOCSIFFLAGS, &ifr) < 0) {
        perror("Unable to set state to UP");
        close(tun_fd);
        exit(1);
    }

    sleep(1);
    if (get_mac_address(&ifr, sock, device->mac) < 0) {
        close(tun_fd);
        exit(1);
    }
}

我理解内核会将tap0的所有流量转发至eth0，但仍不清楚10.0.0.0/8网段的网关位置及对应的网关MAC地址。

内容的提问来源于stack exchange，提问作者Yousef Irshaid