When you restore a net namespace with a VETH device end in it, CRIU will create the other end of the pair in the net namespace you launch CRIU from. By default its name will be the one generated by the veth kernel driver. Not to scan through all the net devices trying to find one, you can use the --external option (opts.external field in RPC) in the form --external veth[NAME]:HOSTNAME@BRIDGE (the @BRIDGE part is optional). When used, a device named NAME in a newly restored namespace will be linked with the HOSTNAME one in the CRIU namespace and, optionally, the host-side device will be added to the BRIDGE bridge device.
Old days
For now CRIU the same functionality was controlled with the --veth-pair NAME=HOSTNAME[@BRIDGE] option and opts.veths RPC field. Soon this option will be deprecated.