Concepts and technologies are disclosed herein for virtual probes. A processor can execute a probe orchestrator service. The processor can obtain traffic monitoring data that describes traffic associated with a logical node. The logical node can include two or more devices that can exchange information as internal traffic. The processor can analyze the traffic monitoring data to determine one of the two or more devices hosts external traffic that involves an external device that resides outside of the logical node. In response to a determination that the one of the two or more devices hosts the external traffic, the processor can trigger instantiation of a virtual probe at the device of the plurality of devices.