diff --git a/src/rabbit_table.erl b/src/rabbit_table.erl
index aed49bbe7437..cc30e28bef84 100644
--- a/src/rabbit_table.erl
+++ b/src/rabbit_table.erl
@@ -301,9 +301,19 @@ definitions() ->
      {rabbit_queue,
       [{record_name, amqqueue},
        {attributes, record_info(fields, amqqueue)},
-       {match, #amqqueue{name = queue_name_match(), _='_'}}]}]
-        ++ gm:table_definitions()
-        ++ mirrored_supervisor:table_definitions().
+       {match, #amqqueue{name = queue_name_match(), _='_'}}]},
+
+     %% Used to track connections across virtual hosts
+     %% e.g. so that limits can be enforced.
+     %%
+     %% All data in this table is transient.
+     {rabbit_tracked_connection,
+      [{record_name, tracked_connection},
+       {attributes, record_info(fields, tracked_connection)},
+       {match, #tracked_connection{_ = '_'}}]}
+
+    ] ++ gm:table_definitions()
+      ++ mirrored_supervisor:table_definitions().
 
 binding_match() ->
     #binding{source = exchange_name_match(),
diff --git a/src/rabbit_upgrade_functions.erl b/src/rabbit_upgrade_functions.erl
index f9ed62b4b261..be296842ec0f 100644
--- a/src/rabbit_upgrade_functions.erl
+++ b/src/rabbit_upgrade_functions.erl
@@ -52,6 +52,8 @@
 -rabbit_upgrade({queue_state,           mnesia, [down_slave_nodes]}).
 -rabbit_upgrade({recoverable_slaves,    mnesia, [queue_state]}).
 -rabbit_upgrade({user_password_hashing, mnesia, [hash_passwords]}).
+-rabbit_upgrade({vhost_limits,          mnesia, []}).
+-rabbit_upgrade({tracked_connection,    mnesia, []}).
 
 %% -------------------------------------------------------------------
 
@@ -86,11 +88,29 @@
 -spec(queue_state/0           :: () -> 'ok').
 -spec(recoverable_slaves/0    :: () -> 'ok').
 -spec(user_password_hashing/0 :: () -> 'ok').
+-spec(vhost_limits/0          :: () -> 'ok').
+-spec(tracked_connection/0    :: () -> 'ok').
 
 -endif.
 
 %%--------------------------------------------------------------------
 
+tracked_connection() ->
+    create(rabbit_tracked_connection, [{record_name, tracked_connection},
+                                       {attributes, [vhost, name, pid, peer_host,
+                                                     peer_port, connected_at]}]).
+
+%% replaces vhost.dummy (used to avoid having a single-field record
+%% which Mnesia doesn't like) with vhost.limits (which is actually
+%% used)
+vhost_limits() ->
+    transform(
+      rabbit_vhost,
+      fun ({vhost, VHost, _Dummy}) ->
+              {vhost, VHost, undefined}
+      end,
+      [virtual_host, limits]).
+
 %% It's a bad idea to use records or record_info here, even for the
 %% destination form. Because in the future, the destination form of
 %% your current transform may not match the record any more, and it