When the network breaks, do you troubleshoot the protocol or the application?

A lot of networking knowledge gets reduced to memorizing things like HTTP, DNS, SSH, TCP, UDP, ICMP, TLS, SMTP, etc.

But in a real outage, these protocols depend on each other in ways that aren't always obvious.

If a service is unreachable, how do you decide where to start troubleshooting?

Do you work your way up from IP → TCP/UDP → TLS → application, or do you start with the application symptom and work backwards?

What's your actual troubleshooting approach when you don't know which layer is failing?