How to verify a real Googlebot (User-Agent isn't enough)

Your access log is full of Googlebot. Some of it is Google. A lot of it isn't. Here's how to tell...