Prove the Block

After containment, verify a later attempt instead of relying only on the current route. You want evidence that the protection held when the program tried again.

The practice computer is isolated. Watch the next interval:

seclab wait

You should see:

Watching the next interval.

demo-upload: practice-laptop -> parcel-cache:443 (isolated)

Read the resulting connection record:

seclab inspect connections demo-upload

Look for these lines:

demo-upload:
  Allowed: no
  Reason: isolated

The attempt was blocked by isolation. This confirms containment, but the process is still present and will need cleanup.

When several computers are involved, verify every affected route. One blocked connection does not prove that another source is contained.