The correct answer is True. ARP poisoning involves sending forged ARP reply packets to the target hosts, causing them to associate the attacker's MAC address with the IP address of another host on the network. This man-in-the-middle position allows the attacker to capture traffic between the two hosts. If the traffic is not encrypted, the attacker can also modify it. This attack may go unnoticed by intrusion detection systems, especially if they are not configured to detect anomalies in ARP traffic.