Look in the machine's System Event Log. Filter the events to show only those from source TCPIP. Look for events 4202, which is a disconnect, and/or event 4201, a reconnection to the network.
You may need to adjust the properties of the event log in order to capture and hold data until you can review it.