It's often unpopular with upper management, but I start by asking (and investigating) (1) What's wrong, (2) when did it last work, *if ever*, and (3) how do we know it doesn't work?
For network/connectivity issues in particular, it's important to me to figure out if it's a single client/user/system or a more pervasive issue. I've seen too many cases where someone put an override in /etc/hosts (or c:\windows\system32\drivers\etc\hosts for those of you of the Windows persuasion) and then "the whole network stopped working" when an IP address changed. Heck, I've done that to myself.
Sometimes an end user or a syadmin escalating to me will spend more time telling me why those are the wrong questions and that we should just reboot the switches or reinstall Windows, than it would've taken to say "we rolled out a big change right before Happy Hour on Friday and when we validated it this morning, it didn't work."
But the closer I can get to the actual problem, and not just the symptom or the "I stayed in a Holiday Inn Express last night" assessment or the "OW MY SPLEEN GET IT OUT OF ME" panic, the sooner I can figure out where to look for the solution.
And from there, it's usually system and network device level tools (traceroute/tcptraceroute, snoop/tcpdump, strace, etc) combined with the central monitoring tool of the year (nagios, bigbrother, montastic, orion, zenoss, zabbix, etc) to track things down.