How do the signaling and data protocol stacks differ in a 2.5G network, and where does NAT happen?

Question

Accepted Answer

Signaling stacks the MM Location Update (phone side) onto MAP Update Location (core side); the data path carries the phone's actual IP packets through GPRS tunnels, with NAT applied at the internet edge.

* User IP tunneled inside GTP over the GPRS core. — Stannered, CC BY-SA 3.0, via Wikimedia Commons. *
Signaling stack (registration):

Phone side: the MM Location Update rides over the radio protocols to the MSC
Core side: the MSC translates into MAP Update Location toward the HLR (over SS7)
Two different protocol worlds, glued together at the MSC

Data stack (2.5G GPRS traffic flow):

The smartphone's actual IP data for the internet is encapsulated and carried through the GPRS core (via SGSN and GGSN)
At the edge to the internet, NAT translates the phone's (private) address — the same pattern still used in LTE at the P-GW

Why see it in Wireshark: Captured traffic from a real mobile network shows these layers stacked: the user's HTTP packet sitting inside GPRS tunneling, next to MAP signaling — making the invisible architecture suddenly concrete. A PCAP from a real network is the best way to internalize that "mobile data" is ordinary IP wrapped in a very particular set of envelopes.
Tip: Keep the two planes separate in your head: signaling (MM/MAP — who you are, where you are) never mixes with user data (IP in tunnels) — they just share the same radio.
Go deeper:

Harald Welte — What happens on a protocol level when I switch on my phone? (CCC, 2018) — shows the signaling and data stacks side by side in real captured traffic, making concrete that "mobile data" is ordinary IP wrapped in GPRS tunnels next to MAP signaling.